Add agentic harness program

[david-hoffman]

Linked issue

Closes #6
Refs #5
Refs #8

Change summary

Implemented the repository-local agentic harness across Phases 0 through 4.

• Phase 0: added intake docs, agent docs, reference manifest, templates, local command wrappers, validation scripts, and aggregate ci-required.
• Phase 1: configured GitHub branch protection, labels, read-only Actions defaults, Dependabot security updates, secret scanning, and push protection.
• Phase 2: enforced clean-context metadata for product source changes and added issue-linked run metadata.
• Phase 3: fixed NumPy 2 utility compatibility failures, recorded coverage baseline, and enabled total and diff coverage gates.
• Phase 4: hardened release workflow with installed-artifact smoke tests, protected environments, and downstream policy.
• CI triage: made PR validation read current GitHub PR metadata when available and separated PR-level role evidence from product-source clean-context evidence.

Phase

• Phase 0 harness bootstrap only
• Phase 1 GitHub protection/configuration
• Phase 2 clean-context enforcement
• Phase 3 coverage ratchet
• Phase 4 downstream/release hardening
• Other: none

Agent workflow evidence

• Scout run metadata committed or not required for this phase
• Red-test author run metadata committed or not required for this phase
• Red tests failed on base commit or not required for this phase
• Implementation run metadata committed or not required for this phase
• Adversarial review run metadata committed or not required for this phase
• Numerics review run metadata committed or not required
• CI triage run metadata committed or not required

Issue #5 includes committed test-author, implementer, adversarial-reviewer, and numerics-reviewer metadata for the split_img product source change.

Issue #8 includes committed test-author, implementer, adversarial-reviewer, and numerics-reviewer metadata for the NumPy 2 doctest compatibility change.

Issue #6 includes committed scout, ci-triager, release-guard, and adversarial-reviewer metadata for the high-risk harness rollout.

Tests and commands

• python -m pytest --doctest-modules dphtools tests: failed before issue Fix NumPy 2 doctest scalar compatibility #8 fix with 3 doctest failures; passed after with 43 passed, 3 warnings.
• make harness-check: passed.
• python -m pytest -q tests/test_utils.py::test_split_img tests/test_utils.py::test_split_img_random: 12 failed before issue Fix NumPy 2 split_img compatibility #5 fix, 12 passed after.
• python -m pytest -q tests: 36 passed, 3 warnings.
• make coverage: passed; coverage gate passed; diff coverage gate passed for 4 changed executable product lines.
• make package: passed; twine check passed.
• make check: passed.
• python scripts/agent_harness/downstream_smoke.py: passed with no known downstream consumers configured.

Coverage

• Line coverage before/after: unknown before; 15.56% baseline recorded; current local run 15.62%.
• Branch coverage before/after: unknown before; 11.30% baseline recorded.
• Diff coverage: enabled; passed for 4 changed executable product lines.

Scientific, hardware, or numerical impact

Facts:

• Product source changes are limited to NumPy 2 compatibility in dphtools/utils/__init__.py.
• split_img now uses np.prod instead of the removed np.product alias.
• mode now returns the documented Python int type instead of a NumPy scalar.
• slice_maker now emits Python integer slice bounds.
• scale runtime behavior is unchanged; doctest examples cast extrema for stable scalar display.
• No numerical tolerance changed.
• No hardware-facing code was found.

Assumptions:

• np.prod(divisors) preserves the intended tile-count product for supported NumPy versions.
• Python integer scalar normalization is compatible with callers because it matches documented behavior.

Guesses:

• No downstream consumer depends on NumPy scalar types for mode or slice_maker outputs.

Public API impact

• No documented public API change
• Public API change documented in design doc and changelog

mode now matches its documented int return type. slice_maker returns equivalent slices with Python integer bounds.

Downstream impact

• Not applicable
• Downstream smoke run
• Downstream impact documented

No downstream consumers were discovered. downstream_smoke.py now passes with an explicit no-known-consumer message.

Release impact

• No release impact
• Release checklist required

Release workflow publishing semantics remain tag-triggered, but publishing is now split across protected environments and includes installed-artifact smoke testing.

Human/admin decisions needed

Human/admin approval is required for this high-risk PR because it changes branch governance, required CI, CODEOWNERS, release workflow behavior, and GitHub release environments. GitHub settings were configured via API and documented under docs/generated/.

[david-hoffman]

Closing per owner request. Future Codex-generated branches should target protected branch codex-main instead of main.