refactor(harness): declare adapter config checks with matchers in descriptors

[yanxz]

Motivation

First stage of RFC #797: config checks, which supersede locked (#737). Checks for the other node kinds are not implemented here. Part of #681.

Changes

• Add reef/harness/adapters/matchers.py, a GoogleTest-style matcher subset and a parser for match expressions.
• Replace files.config.<target>.locked with checks. The shared render runs them before any adapter step.
• Move the config rules of claude, codex, dsh, hermes, pi and terminus from quirks.py into their descriptors. Convert opencode's locked list; its cross-reference checks stay in Python.
• Also add tests for all the descriptor.yaml files of bundled harnesses, to make sure they are legit. This is especially important considering the matcher string is non-trivial to get right.

Documentation impact

• Reader question: how does an adapter declare what its config must keep or must not set?
• Updated page: "Config checks" in docs/developer-guide/harness-adapters.rst.
• Verification: the documentation build was not run.

Compatibility and operational impact

The loader no longer reads locked; a descriptor must declare checks instead. Refusal messages change format. The RFC lists the refusals that are stricter or looser than before.

The install route renders a release again with the model binding, and it swallows a RenderError and installs the tree without a binding. A release published before this change that fails one of the stricter checks therefore installs with no model binding and no error, until the install route stops dropping render errors (a separate follow-up).

Verification

• pytest tests/harness/test_harness_config_checks.py: 91 passed. It loads every bundled descriptor, so a malformed match expression fails here; checked by misspelling one matcher.
• pytest tests/harness after merging main: 1146 passed, 15 skipped, 1 failed. The failure, test_native_plugins.py::test_every_kind_installs_into_the_host_and_leaves_nothing_when_the_entry_leaves, also fails on main.
• python .github/scripts/check_test_layout.py: passed.
• pre-commit run --files <changed files>: passed.
• mypy: no new errors. The existing reef/observability/open_telemetry.py errors remain.
• Not run: the full tests/ suite, which needs the training environment, and real-binary smoke tests.

AI assistance

Claude Code implemented the change and drafted this description under the author's direction. The author is still reviewing it.

Checklist

• The change is focused and contains no unrelated cleanup.
• Changed code satisfies the style, code structure, and naming rules in AGENTS.md. Author review is pending.
• Tests cover behavior changes, or this pull request does not change behavior.
• Public interface changes include contract tests, or no public interface changes are present.
• Affected documentation is updated and reviewed against the Documentation review checklist in AGENTS.md. Author review is pending.
• Root README changes update both languages and README.i18n.yaml, or do not affect README content.
• An accepted RFC is linked, or this change does not require an RFC. The RFC is not accepted yet.
• Relevant pre-commit and test checks pass.
• Non-trivial AI assistance is disclosed above, or none was used.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[BobbyZhouZijian]

@hanfeiyu it seems the doc rule might be relevant to this PR. just fyi