docs: make Harness event driven and add quality gates

[KeepSilenceQP]

What changed

Event-driven Harness orchestration

• Define the concrete role mindset for 小P, 云上C总, 小C / 云上小C, and 秦鹏.
• Make real at-bot dispatch and formal return messages the orchestration mechanism.
• Keep Plan progress ownership with 小P, while updating state only after confirmed result events.
• Remove wording that could imply polling or holding an Agent turn open.
• Synchronize the Harness, role cards, core workflow Spec, README, CHANGELOG, confirmed Spec, and implementation Plan.

Repository CI

Add three independent GitHub Actions gates:

1. Markdown lint
   • Node.js 24
   • locked markdownlint-cli2@0.23.1 dependency
   • all standard rules enabled except Chinese prose line length and the YAML metadata-title false positive
2. Harness contract tests
   • full-snapshot whitespace validation
   • six unit tests for validator primitives
   • required control-plane files
   • Markdown encoding, final newline, conflict markers, and relative links
   • ordered role-card, Harness, and Task Brief structure
   • required at-bot return contract
   • accidental static Lark Bot open ID detection
3. GitHub Actions lint
   • actionlint@1.7.12
   • release archive verified by SHA-256 before execution

Official GitHub Actions are pinned to full commit SHAs. The npm lockfile uses the public npm registry and includes package integrity hashes.

Why

The previous Harness run led 小P to keep monitoring other Bots after dispatch instead of ending the current turn and waiting for a formal at-bot return.

The repository also lacked automated quality gates. The first minimal CI only checked a custom structural validator; this revision replaces it with standard Markdown and Workflow linters plus tested, repository-specific Harness contracts.

Impact

Harness orchestration is explicitly cross-turn and event driven:

1. 小P dispatches through at-bot.
2. 小P ends the current Agent turn.
3. The target Bot returns a formal result through at-bot.
4. 小P consumes that event, updates the existing Plan state, and routes the next stage.

CI runs on pull requests, pushes to main, and manual dispatch. It does not modify Bridge runtime behavior or add polling, schedulers, or background workers.

Validation

• npm ci — public locked dependencies, 0 vulnerabilities
• npm run ci — Markdown 19/19 clean; 6/6 validator tests pass; 6 role cards and Harness contracts pass
• git diff --check
• actionlint@1.7.12 local validation
• GitHub Actions run 29940957928 — all three gates passed
• Spec confirmed
• Plan review: PASS
• Independent implementation review: GO