docs(ops): add self-hosted operator harden pack

[telivity-otaip]

Summary

Adds a self-hosted operator harden pack under ops/harden/ so operators can verify auth, tenant isolation, and desk workflows before go-live.

What's included

• CLI probes (ops/harden/cli/) — local file/compose checks plus live health, auth-on, and tenant-isolation HTTP probes
• Checklists — CHECKLIST.md, SURFACE_SMOKE.md, TENANT_ISOLATION.md, PRODUCTION.md
• 20 desk vignettes (ops/harden/vignettes/base-01 … base-20)
• Root wiring — pnpm harden:local / pnpm harden:live / pnpm harden in package.json; .env.harden gitignored

How to run

# File/compose checklist (optional HTTP if HAIP_API_BASE is set)
pnpm harden:local

# Live probes against your API (needs HAIP_API_BASE + tokens — see ops/harden/.env.harden.example)
pnpm harden:live

Copy ops/harden/.env.harden.example → .env.harden and source it before live mode.

See ops/harden/README.md for the full operator flow.

Note: This branch supersedes cursor/operator-harden-pack-a0ac (clean rebuild from main).