feat(harness): resolve stable roles to Directory agents with 0600 local credentials

## Parent
- #436

## Goal
Provide a portable bootstrap/resolver that maps a stable project role to exactly one active Directory agent ULID and validates its local scoped credential without leaking secrets.

## Scope
- Resolve by stable role against the canonical PlatformDirectory role projection.
- Require exactly one active match and validate kind/areas/reports_to.
- Read or create the gitignored local credential cache with mode 0600; accept token through an interactive prompt/stdin, never argv.
- Verify token-to-ULID binding through the scoped identity endpoint.
- Atomically migrate the existing cache; preserve valid credentials and rotate only on mismatch.
- Export/use the immutable ULID as runtime `COORD_AGENT_ID`.

## Acceptance
- Zero/multiple/mismatched/retired identities fail closed with actionable errors.
- Wrong file mode and token/ULID mismatch fail closed.
- Logs and tests never print token material.
- Existing valid cache migrates without secret rotation.
- `./init.sh` passes.

## Dependencies
- #436
- portable surface generator child
- scoped identity endpoint child
- #396 / PR #402

Start with the portable bootstrap/resolver and the canonical PlatformDirectory role projection, then inspect the scoped identity endpoint and existing local credential cache migration. Use ./init.sh while checking the COORD_AGENT_ID export. Done means identity resolution and credential validation fail closed, valid caches migrate unchanged, and tests and logs never expose token material.

Written by the indexing model from the issue text.