events: config surface for the webhook receiver

[events] listen/state_dir plus per-source secret refs (env:/file:/literal:)
for redmine, discourse and gitea webhooks. Defaults: :4100, state/events,
X-Redmine/X-Discourse-Webhook-Secret headers. Refs validate fail-fast; set
refs must be well-formed or config load names the [events.*] section.

harness.toml.example

@@ -102,3 +102,24 @@ id = "demo-1"
 subject = "MVP demo: GLM self-description"
 prompt = "tell me about yourself"
 class = "primary"
+
+# EVENTS: the `harness events` webhook receiver (Redmine/Discourse/Gitea
+# punch the harness; DESIGN "Events are V1 scope"). Secrets are refs only,
+# resolved at startup, never logged. At least one secret_ref must resolve
+# or the receiver refuses to start.
+[events]
+listen = ":4100"            # bind address; publish on the LAN via docker -p
+state_dir = "state/events"  # append-only events.jsonl + dedup index
+
+[events.redmine]
+secret_ref = "env:HARNESS_REDMINE_WEBHOOK_SECRET"
+# secret_header = "X-Redmine-Webhook-Secret"   # default; match your plugin
+
+[events.discourse]
+secret_ref = "env:HARNESS_DISCOURSE_WEBHOOK_SECRET"
+# secret_header = "X-Discourse-Webhook-Secret"  # default
+
+[events.gitea]
+secret_ref = "env:HARNESS_GITEA_WEBHOOK_SECRET"
+# Gitea always verifies via HMAC-SHA256 in X-Gitea-Signature; the
+# secret_header override does not apply to it.