Tooling: Harness mutation regression suite for workflow and policy changes

> **Roadmap:** Exposed project specifications; workflow promotion gate
> **Priority:** P2

## Component

Other

## Describe the feature

CI regression suite that treats **harness mutations** (workflow YAML, Cedar policies, contract fixtures) like safety-critical code changes. On changes to `agent/workflows/**`, `agent/policies/**`, or `contracts/**`, run golden trajectory fixtures and cedar-parity tests; fail on event-order, policy decision, or terminal-state regressions.

Implements arXiv:2605.18747 §5.2.3: harness edits require held-out regression suites and rollback discipline.

## Use case

- **Contributors** changing workflows or Cedar rules get immediate feedback before deploy.
- **Workflow promotion** (`draft → production`) gains an automated gate beyond unit tests.
- **Operators** forking workflows have a template for their own regression fixtures.

## Proposed solution

1. Depends on golden PEV trajectory fixtures (`contracts/harness-trajectories/` — separate issue).

2. GitHub Actions job (or extend existing build workflow):
- Trigger paths: `agent/workflows/**`, `agent/policies/**`, `contracts/**`
- Run: workflow-validation, cedar-parity, golden trajectory diff
- Output: fixture diff on failure

3. Document operator expectation: production workflow changes require green regression suite.

### Acceptance criteria

- [ ] CI job triggers on harness-relevant path changes
- [ ] Fails with actionable diff when golden trajectory or cedar-parity regresses
- [ ] Documented in `CONTRIBUTING.md` or developer guide
- [ ] Works without live Bedrock (mocked agent/orchestrator responses)

## Other information

- **Blocked by (soft):** Conformance golden PEV trajectories issue
- **Related:** Workflow promotion gate in `WORKFLOWS.md`
- **Paper:** arXiv:2605.18747 §3.5, §5.2.3 governed harness mutation

## Acknowledgements

- [ ] I may be able to implement this feature
- [ ] This might be a breaking change

Inspect changes under agent/workflows/**, agent/policies/**, and contracts/**, then review the existing build workflow and the related promotion guidance in WORKFLOWS.md. The separate contracts/harness-trajectories issue is a dependency; completion requires path-triggered CI, workflow-validation, cedar-parity, and golden trajectory checks with actionable diffs, mocked responses, and documentation in CONTRIBUTING.md or the developer guide.

Written by the indexing model from the issue text.