[P1][CODE-02] Safe files, process tools and artifact generation

Programme: #1
Epic: #24

## Objective
Give agents and users first-class file/process capabilities now—without waiting for an OS—through scoped, typed and recoverable operations.

## Scope
- File capabilities: read/write/create/open/rename/move/copy/delete with project/directory/object scope.
- Atomic save where possible, version history and preview before destructive changes.
- Format-aware artifact workers for common documents, archives, code/config and media metadata.
- Bounded process/terminal execution with cwd, env, executable, args, timeout, network and filesystem policy.
- Generated artifact validation and MIME/type sniffing.
- Safe opening/launching of generated/downloaded artifacts.
- Process output/artifact capture into task journal.

## Security rules
- Terminal availability does not imply universal shell authority.
- Generated files, macros, scripts and packages are untrusted even when created by our model.
- Dependency installation/network access is a separate capability.

## Acceptance criteria
- [ ] File operations outside granted roots fail closed.
- [ ] Destructive operations are versioned/previewed where supported and correctly classified for undo.
- [ ] Process runners receive clean scoped environments and enforce timeout/resource/network policy.
- [ ] Generated artifacts validate before publication/opening.
- [ ] Macro/script/package content cannot execute through a privileged preview path.
- [ ] File/process actions survive crash recovery with unambiguous journal state.

## Dependencies
- SEC-02
- SEC-04
- CORE-02

**First phase:** P1
**Maturity target:** P4
**Owner:** harness-pc-providers

No files, tests, or entry points are named; start by reading the SEC-02, SEC-04, and CORE-02 dependencies and locating the existing capability and task-journal boundaries. Done requires implementing the scoped file/process and artifact behaviors in the acceptance criteria, including policy enforcement, validation, safe previews, and crash-recoverable journal state.

Written by the indexing model from the issue text.