Validate a harness overlay — cyberine harness check (kdgkp)

A harness overlay is a directory of proposed edits to what Cyberine injects into workers: rules/<name>.md (replaces or adds a project rule file in .cyberine/rules/), skills/<id>/SKILL.md and files beside it (replaces or adds a project skill in .cyberine/skills/), and brief.md (a note for the task brief). The check runs before an overlay is used, and lists every problem in one pass so an improver can fix them together.

cyberine harness check                          # the repo's current .cyberine/rules and .cyberine/skills
cyberine harness check --overlay ./my-overlay   # the tree as it would be with the overlay applied
cyberine harness check --overlay ./my-overlay --json

Rejected, each with its own line:

• a file outside the surface above (a hook, a plugin, a settings file);
• always-on rules (global <CYBERINE_HOME>/rules plus project rules, with the overlay applied) longer than the rules preamble cap, 4 x CYBERINE_RULES_MAX_TOKENS characters, the same cap buildRulesPreamble truncates at;
• a skill whose frontmatter has no description: line, so nothing says when to load it;
• a backticked script path (.sh, .ts, .mjs, .js, .py ...) that exists neither in the repo nor in the overlay;
• any change to invariants, permissions, secrets handling or owner rules: an overlay file named like an invariants file, an edit to a base file whose text carries any of those, or an added line that names one of them.

Exit 0 when the tree passes, 1 with the problem list otherwise, 2 on a usage error.

Known Limitations and Deferred Work: the guarded-topic check matches words (permission, sandbox, secret, API key, owner, operator, invariants ...), so a harmless line using one of them is refused too, and a line that grants authority without those words is not caught; it narrows what an automatic improver can change, it is not a proof. An overlay cannot delete a base file. Rule frontmatter paths: filters are ignored when sizing the always-on text, so the size check assumes every rule applies. The failure-triggered harness repair (CYBERINE_HARNESS_REPAIR, k5dc7) runs it on every overlay its improver proposes.