docs(ops): add self-hosted operator harden pack (superseded by #286)

[telivity-otaip]

Summary

Adds a self-hosted operator harden pack under ops/harden/ so operators can verify auth, tenant isolation, and desk workflows before go-live.

What's included

• CLI probes (ops/harden/cli/) — local file/compose checks plus live health, auth-on, and tenant-isolation HTTP probes
• Checklists — CHECKLIST.md, SURFACE_SMOKE.md, TENANT_ISOLATION.md
• 20 desk vignettes (ops/harden/vignettes/base-01 … base-20) for post-smoke delight/annoy/block scoring
• Root wiring — pnpm harden:local / pnpm harden:live / pnpm harden scripts; .env.harden gitignored

How to run

# File/compose checklist (optional HTTP if HAIP_API_BASE is set)
pnpm harden:local

# Live probes against your API (needs HAIP_API_BASE + tokens — see ops/harden/.env.harden.example)
pnpm harden:live

Copy ops/harden/.env.harden.example → .env.harden and source it before live mode.

See ops/harden/README.md for the full operator flow.

[telivity-otaip]

Superseded by #286 (clean rebuild from main on cursor/operator-harden-pack-v2-a0ac).