harness: single-shot conductor + CLI with MVP demo path

`harness once` runs one bounded iteration (intake -> routing -> bounded turn
-> REPORT) then exits, so callers chain it without a daemon. The bounded
turn loops request -> tool calls -> results up to max_rounds; gate denials
feed back to the model and are counted instead of failing the turn.
--dry-run prints the plan (task, resolved model, tool bounds) and makes zero
LLM calls; --demo runs the [demo] issue ("tell me about yourself" through
LiteLLM -> GLM self-description as the REPORT), the MVP acceptance bar.
Distinct exit codes for config/usage, intake, and llm failures. Ships
harness.toml.example (scope query, tier map, allow-lists); real configs are
gitignored. Loop tests run end-to-end against a scripted fake OpenAI server:
demo turn, dry-run zero-call, tool round-trip, denial counting, round limit,
and error-class mapping.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

README.md

@@ -1,4 +1,16 @@
 # MOPAC harness
 
 Headless multi-vertical agent harness in Go. AGPLv3. SoR: Redmine project MOPAC; docs: Discourse; code: Gitea reachableceo/MOPAC.
-Spec: DESIGN.md. Status: see Redmine MOPAC project issues.
+Spec: DESIGN.md. Status: see Redmine MOPAC project issues and REPORT.md.
+
+## Build & run (v0 skeleton)
+
+    go build ./... && go vet ./... && go test ./...
+    cp harness.toml.example harness.toml      # then set the key refs
+    ./bin/harness once --dry-run --demo       # intake + plan, no LLM call
+    HARNESS_LITELLM_KEY=sk-... ./bin/harness once --demo   # MVP demo turn
+
+`harness once` runs ONE conductor iteration (intake -> model routing ->
+bounded turn via LiteLLM -> REPORT file) and exits; chain iterations by
+re-invoking. There is no daemon. Exit codes: 0 ok, 1 config/usage,
+2 intake, 4 llm/turn. See `harness help`.