harness(p0): add VERSION marker + OOB recovery script (Tasks 0.5, 0.6)

Safety prerequisites for the P0 rollout, landed BEFORE any sync.sh change so a bad
harness change cannot strand a node. .claude/harness/VERSION (1.0.0) lets a session
detect partial rollout; .claude/scripts/force-pull-raw.sh is a hook-free git rescue
(dry-run by default; --confirm hard-resets to origin/main, saving prior HEAD to a
recovery branch).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/harness/CHANGELOG.md

@@ -0,0 +1,12 @@
+# Harness CHANGELOG
+
+The ClaudeTools harness version marker (`.claude/harness/VERSION`). Bump on every
+fleet-visible behavioral change so a session can detect whether it is running the new
+or old harness during a heterogeneous rollout. See
+`specs/claudetools-harness-optimization/`.
+
+## 1.0.0 — 2026-06-08
+- Task 0.5: VERSION marker established (this file).
+- Task 0.6: out-of-band recovery script `.claude/scripts/force-pull-raw.sh` added.
+- (Earlier) Syncro billing SSOT resolved: `add_line_item` is normal billing; timers are
+  outlier-only (explicit request).

.claude/harness/VERSION

@@ -0,0 +1 @@
+1.0.0

.claude/scripts/force-pull-raw.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+# OOB harness recovery. Rescues a node whose normal /sync or /save is broken by a bad
+# harness change. Hook-free, guard-free, minimal deps. Resets the ClaudeTools repo to
+# origin/main. Does NOT touch the vault or submodules.
+#
+#   bash .claude/scripts/force-pull-raw.sh            # dry-run: show what would change
+#   bash .claude/scripts/force-pull-raw.sh --confirm  # hard-reset to origin/main
+#
+# --confirm first saves your current HEAD to a local branch recovery/pre-force-pull-<sha>
+# so no committed work is truly lost.
+set -uo pipefail
+ROOT=$(git rev-parse --show-toplevel 2>/dev/null) || { echo "[ERROR] not in a git repo"; exit 1; }
+cd "$ROOT"
+echo "[force-pull-raw] repo: $ROOT"
+if ! git fetch origin 2>&1 | tail -2; then echo "[ERROR] git fetch origin failed"; exit 1; fi
+LOCAL=$(git rev-parse --short HEAD 2>/dev/null)
+REMOTE=$(git rev-parse --short origin/main 2>/dev/null)
+echo "--- local HEAD: $LOCAL | origin/main: $REMOTE ---"
+echo "--- working-tree changes a hard reset would discard ---"
+git status --short
+echo "--- local-only commits a hard reset would discard ---"
+git log --oneline origin/main..HEAD 2>/dev/null | head
+if [ "${1:-}" != "--confirm" ]; then
+  echo ""
+  echo "DRY RUN. Re-run with --confirm to hard-reset to origin/main (discards the above;"
+  echo "current HEAD will be saved to a local recovery branch first)."
+  exit 0
+fi
+git branch -f "recovery/pre-force-pull-$LOCAL" HEAD 2>/dev/null || true
+git reset --hard origin/main
+echo "[OK] reset to origin/main ($REMOTE). Prior HEAD saved at recovery/pre-force-pull-$LOCAL"