[E9-T4] Define Claude Code AgentTemplate and governed ClaimRequest fixtures

## Outcome

Canonical fixtures describe a governed Claude Code task using the existing backend-neutral AgentTemplate and ClaimRequest contracts, and prove that requested access is narrowed by authority resolution rather than automatically granted.

## Delivery contract

- **Parent Epic:** #13 (E9)
- **Size:** S
- **Can start after:** #53 (engineer artifact pattern), #22 (contract fixtures)
- **Integrates into:** #117, #118, #119
- **Integration Stage:** Fixture / Mock
- **Wave:** Wave D — Understandable delivery
- **Sequence:** 904

## Acceptance criteria

Add and index new fixtures in `harness/fixtures/contract/v0/`; do not rewrite the frozen #22 inputs:

- A valid Claude Code AgentTemplate with `tool.action` capability names, a logical model profile, supported runtime profile, and a 30-minute ceiling. Use the existing schema fields, including `capabilityCeiling.modelProfiles`; no issued authority or credentials.
- A valid Team A `coding-task` ClaimRequest within the template ceiling.
- A schema-valid Team A ClaimRequest requesting an additional ungranted tool and a 45-minute timeout. Its manifest outcome is **valid**, not a schema-invalid ceiling case.

Tests directly consume the fixtures and prove:

- `ValidateAgentTemplate()` and `ValidateClaimRequest()` accept their valid shapes.
- The existing admission and authority-resolution path removes the ungranted tool and caps runtime at 30 minutes. Assert the exact requested and effective values; do not change the resolver to reject the whole request.
- No request field creates authority, and no provider secret is present.

## Quality gate and evidence

- Run the focused fixture/parser/resolution suite and `./scripts/check.ps1 -All`.
- Record fixture case IDs and exact test output showing both within-ceiling and narrowed-request behavior.

## Non-goal

- Live Claude Code or provider integration, changes to core API shapes or resolution semantics, downstream proxies, or claim execution.

## Definition of Done

The new fixtures are indexed and directly tested, requested-versus-effective narrowing is observable, and the repository baseline passes.

## Approved correction

2026-09-15: Owner approved alignment with the existing contract: template ceilings are applied during authority resolution; a schema-valid over-ceiling request is narrowed, not rejected by ClaimRequest schema validation.

Start with the existing fixtures in harness/fixtures/contract/v0/ and the ValidateAgentTemplate(), ValidateClaimRequest(), admission, and authority-resolution paths. Add indexed Claude Code fixture cases, then run the focused fixture/parser/resolution suite and ./scripts/check.ps1 -All; done means valid requests are accepted and the resolution output shows the ungranted tool removed and the timeout capped at 30 minutes.

Written by the indexing model from the issue text.