feat: add review-first harness setup plugin

[pftg]

Summary

• Add harness-setup v0.1.0 with explicit setup, a callable verification helper, and four read-only agents.
• Discover current capabilities, reconcile project context, clarify only decision-changing gaps, and reuse existing tools before authoring one missing capability.
• Provide a standard-library metadata scanner and restricted stage/check/diff/apply/rollback utility.
• Register the plugin in the existing marketplace; add installation documentation, a changelog and scoped Linux/macOS CI.
• Promote 16 independent adversarial regressions into the permanent test suite. Keep private notes, configuration scans and historical research artifacts out of the repository.
• Require private recommendation output outside the consuming checkout, or verified Git exclusion before writing sensitive project-local artifacts.

Safety boundaries

• No bundled hooks, MCP servers, model pins, provider-field edits or automatic installation.
• Created skill/agent frontmatter is restricted; symlinked paths, hardlinked mutable targets, drift, expired applications and incorrect digests are rejected.
• Permission arrays explicitly replace while retaining every existing ask/deny rule.
• The operator reviews the exact diff and runs apply. The digest is integrity, not human authentication; same-privilege processes are not sandboxed.
• Enabling another installed plugin can activate its code/hooks and requires separate trust review.
• Recovery is per-file with compensation for caught failures, not whole-tree atomicity or crash-proof recovery.

Validation

• 92/92 plugin tests pass on Linux, Python 3.14.3 and independently on Python 3.12.13, with no skips.
• Existing research-inbox suite: 8/8 pass.
• Standalone plugin copy: 91 pass; the one repository-only marketplace check is correctly skipped.
• Claude Code 2.1.220: strict plugin validation and discovery of 2 skills / 4 agents pass.
• Marketplace validation passes with the same two warnings as the untouched base. Strict validation fails on both base and candidate because of the existing interface field and missing marketplace description; this PR does not change that unrelated metadata.
• actionlint 1.7.12 and git diff --check pass.
• Independent local integration review: GO for a draft PR, no open findings; final commit reviewed.
• Remote GitHub Actions and authenticated Claude model/tool-denial tests have not run.

Before marking ready for merge

• GitHub Actions pass on Linux/Python 3.10, Linux/Python 3.14 and macOS/Python 3.14.
• A maintainer reviews the complete diff and the updater's stated trust boundary.
• Disposable authenticated Claude acceptance proves explicit setup, verification handoff, actual read-only child tools and unchanged provider routing.

Keep this PR in draft until these gates are met. No merge, release, live harness installation or configuration application is requested by this PR.