refactor(harness-config): move the .claude/audit-pass.md (its suppressions block) settings to docs/conventions/harness-config.yaml #9732

Parent

Refs #5906

Depends on

• none: on the frontier now

Outcome

The harness-config settings this repository keeps in .claude/audit-pass.md (its suppressions block) resolve from docs/conventions/harness-config.yaml,
validated by a schema the plugin ships. The old location is read only when the YAML is absent, for one release.
The setup skill, if the plugin has one, writes the YAML.

Decisions

• ADR 0064 Decision 1: a plugin's team settings live in one docs/conventions/<concern>.yaml, validated by a
  JSON Schema at plugins/<plugin>/schemas/<concern>.schema.json (Decision 6), checked in CI by
  scripts/check-convention-yaml.sh (Decision 7). Script readers use the shared reader lib/parse-concern-value.sh.
• ADR 0075: layers are plugin default < userConfig < team <home>/<concern>.yaml < personal
  <home>/<concern>.local.<ext>; every resolver reports the layer that supplied each value.
• Migrate per-skill .claude config files to userConfig, one conventions doc, or the cascade (ADR 0018) #5906 (comment 2026-10-04): each reader keeps reading the old file for one release when the new file is
  absent, and this repository keeps its old file until the cleanup slice.

Key interfaces

• /harness-config:audit and /harness-config:audit-pass suppression readers (audit-engine.sh), keyed by finding_id per docs/conventions/finding-suppression; if that convention names a different concern for suppressions, follow it and say so in the PR.

Done when

• docs/conventions/harness-config.yaml carries every value of .claude/audit-pass.md (its suppressions block) and scripts/check-convention-yaml.sh --check exits 0 against plugins/harness-config/schemas/harness-config.schema.json.
• scripts/run-test-file.sh plugins/harness-config/skills/audit/scripts/audit-engine.test.sh exits 0.
• The reader's tests include: the YAML wins when both exist, the old location is read when the YAML is absent, and the resolver names the layer that supplied each value.
• No skill body tells an agent to read or write the old location: git grep -n for it under plugins/harness-config prints only compatibility-read code, its tests and changelog lines.
• The PR body lists each migrated setting with its new home and schema.
• scripts/check-changelog-fragments.sh --check-required origin/main exits 0.

Out of scope

• Deleting this repository's old file or block (the cleanup slice under Migrate per-skill .claude config files to userConfig, one conventions doc, or the cascade (ADR 0018) #5906).