Add harness app: agent orchestrator with cluster deployment

- Next.js app for orchestrating coding agent benchmarks (Claude Code, Codex, OpenCode)
- Dockerfile installs git, gh CLI, and agent CLIs for headless execution
- K8s deployment with workspace volume, sealed credentials for Claude + OpenCode
- Traefik IngressRoute at harness.coreworlds.io with internal-only middleware + TLS
- CI pipeline path filter for harness builds
- Fix OpenCode runtime flags (subcommand-based headless mode)

apps/harness/k8s/base/deployment.yaml

@@ -0,0 +1,67 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: harness
+  labels:
+    app: harness
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: harness
+  template:
+    metadata:
+      labels:
+        app: harness
+    spec:
+      imagePullSecrets:
+        - name: ghcr-pull-secret
+      containers:
+        - name: harness
+          image: ghcr.io/lazorgurl/homelab-harness:latest
+          ports:
+            - containerPort: 3100
+          env:
+            - name: HARNESS_WORK_DIR
+              value: /data/harness
+            - name: CLAUDE_CONFIG_DIR
+              value: /secrets/claude
+            - name: OPENCODE_CONFIG_DIR
+              value: /secrets/opencode
+          volumeMounts:
+            - name: workspace
+              mountPath: /data/harness
+            - name: claude-credentials
+              mountPath: /secrets/claude
+              readOnly: true
+            - name: opencode-credentials
+              mountPath: /secrets/opencode
+              readOnly: true
+          resources:
+            requests:
+              memory: 256Mi
+              cpu: 100m
+            limits:
+              memory: 1Gi
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: 3100
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: 3100
+            initialDelaySeconds: 15
+            periodSeconds: 20
+      volumes:
+        - name: workspace
+          emptyDir:
+            sizeLimit: 2Gi
+        - name: claude-credentials
+          secret:
+            secretName: harness-claude-credentials
+        - name: opencode-credentials
+          secret:
+            secretName: harness-opencode-credentials