M0: scaffold Cargo workspace, core types, event bus, permission engine, storage actor

Seven-crate workspace per docs/01-architecture.md. harness-core gets the
domain types (Session/Message/Part/ToolState), a broadcast EventBus, the
last-match-wins wildcard permission evaluator, and a SQLite storage actor
(dedicated thread + mpsc, JSON-blob rows) with roundtrip tests. All other
crates are compiling stubs. CI runs fmt/clippy -D warnings/test.

crates/harness-app/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "harness-app"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+harness-core = { workspace = true }
+harness-providers = { workspace = true }
+harness-tools = { workspace = true }
+harness-mcp = { workspace = true }
+harness-lsp = { workspace = true }
+
+[lints]
+workspace = true

crates/harness-app/src/lib.rs

@@ -0,0 +1 @@
+// Composition root: builds the Engine and registers providers/tools/mcp/lsp. Lands in M1+.