Implement agentic harness program

[david-hoffman]

Problem statement\nImplement the repository-local agentic harness described in docs/harness/agentic_harness_spec.md.\n\n## Desired behavior\nThe repository should have Phase 0 through Phase 4 harness controls: intake docs, references, CI gate, branch protection, clean-context metadata enforcement, coverage ratchets, downstream policy, and release hardening.\n\n## Out of scope\nNo broad product refactor. No package backend migration. No publishing run.\n\n## Acceptance criteria\n- Harness docs, templates, and validation scripts exist.\n- ci-required is the aggregate required gate.\n- main branch is protected.\n- Required labels exist.\n- Clean-context metadata is enforced for product source changes.\n- Coverage baseline and diff coverage gates are enabled.\n- Release workflow uses protected environments and installed-artifact smoke tests.\n- Downstream policy documents no known consumers.\n- make check passes locally.\n\n## Risk\nrisk:high\n\n## Human/admin approval\nRequired for branch protection, release environments, and protected workflow changes.\n