harness-app + harness-tui: composition root and harness run -p debug command

App::init wires config loading, an in-memory Store, EventBus, PermissionService
with the M1 auto-approve stub frontend, the full built-in ToolRegistry, and a
ProviderRegistry populated with AnthropicProvider when an API key is available
(config or ANTHROPIC_API_KEY). App::run_prompt creates a root session, appends
the prompt as a user message, and drives engine::run_session to completion;
final_text reads back the concatenated text parts of the last message.

harness-tui's `harness` binary gains a `run -p "<prompt>" [-m provider/model]`
subcommand built on this. Manually verified end-to-end against the real
Anthropic API: an empty API key produced a genuine 401 that our SSE error
path correctly classified as ProviderError::Auth and surfaced as a clean
CLI error message (exit 1) -- confirming the full request/header/error-
handling pipeline works against the live service, not just fixtures.

This closes M1 (docs/10-milestones.md): headless core loop + Anthropic
provider, config loading, all six built-in tools, and the debug CLI.
131 tests passing across the workspace, clippy clean, fmt clean.

Cargo.lock

@@ -509,11 +509,16 @@ dependencies = [
 name = "harness-app"
 version = "0.1.0"
 dependencies = [
+ "dirs",
  "harness-core",
  "harness-lsp",
  "harness-mcp",
  "harness-providers",
  "harness-tools",
+ "tempfile",
+ "thiserror 2.0.18",
+ "tokio",
+ "tokio-util",
 ]
 
 [[package]]
@@ -598,6 +603,8 @@ name = "harness-tui"
 version = "0.1.0"
 dependencies = [
  "harness-app",
+ "harness-core",
+ "tokio",
 ]
 
 [[package]]