docs + dev.sh: loop in README/REPORT, ./dev.sh loop runner, scan-failure exit codes

README gains the self-host loop section (flow diagram, config reference
rows for [loop]/[redmine.status_map]/[keyproxy]/[gitea], CLI flags,
status table); REPORT.md records phase 3a including the die list for the
bash stack it replaces. dev.sh grows a `loop` runner (repo bind-mounted,
key env passthrough). `harness loop --once` now exits 2 when the intake
scan itself fails so cron setups alert loudly; daemon mode still logs
and retries.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

dev.sh

@@ -3,13 +3,16 @@
 # digest-pinned Docker builder (DESIGN "ALL dev work in Docker" — big rule);
 # the host runs containers, never toolchains.
 #
-# Usage: ./dev.sh {build|vet|test|check|events|smoke|shell} [args...]
+# Usage: ./dev.sh {build|vet|test|check|events|loop|smoke|shell} [args...]
 #
 #   build    compile ./cmd/harness into bin/harness
 #   vet      go vet ./...
 #   test     go test ./...
 #   check    build + vet + test (the pre-commit gate)
 #   events   run `harness events` with host port 4100 published (LAN smoke)
+#   loop     run `harness loop` (the self-host daemon; repo bind-mounted so
+#            REPORTs + state/loop/loop.jsonl land in the repo; key env vars
+#            passed through; args go to the loop, e.g. `./dev.sh loop --once`)
 #   smoke    full webhook smoke: starts events in a container, POSTs via
 #            python urllib (curl is banned on host), shows 401/200 + JSONL,
 #            tears the container down
@@ -48,6 +51,16 @@ events)
         -e HARNESS_GITEA_WEBHOOK_SECRET \
         "$IMAGE" /h/bin/harness events -listen ":4100" "$@"
     ;;
+loop)
+    # Self-host daemon: repo bind-mounted (REPORTs + loop.jsonl land in the
+    # repo); key refs' env vars passed through. Stop with SIGINT/double Ctrl-C
+    # or `docker stop mopac-loop`.
+    exec docker run --rm -i --name mopac-loop \
+        -v "$PWD:/h" -w /h -u "$(id -u):$(id -g)" -e HOME=/tmp \
+        -e HARNESS_REDMINE_KEY -e HARNESS_LITELLM_KEY -e HARNESS_GITEA_KEY \
+        -e HARNESS_KEYPROXY_TOKEN \
+        "$IMAGE" /h/bin/harness loop "$@"
+    ;;
 smoke)
     ./smoke/smoke.sh
     ;;
@@ -55,7 +68,7 @@ shell)
     run sh
     ;;
 *)
-    echo "dev.sh: unknown command $cmd (build|vet|test|check|events|smoke|shell)" >&2
+    echo "dev.sh: unknown command $cmd (build|vet|test|check|events|loop|smoke|shell)" >&2
     exit 1
     ;;
 esac