feat(harness-guard): FATAL-promotion prerequisite — test matrix + pair-required conflict rule (VERSION 1.4.3)

Builds the false-positive/true-positive proof the plan requires before the guard can be
promoted to blocking, and fixes the one false-positive it surfaced.

- test-harness-guard.sh: 12-case matrix in a throwaway repo, runs the REAL guard, asserts
  WARN/clean for real conflicts/secrets/keys vs legit content (setext underlines, dividers,
  docs that mention a marker, encrypted sops, public keys, .example templates).
- harness-guard.sh: conflict rule now requires a real hunk (BOTH ^<<<<<<< AND ^>>>>>>>),
  dropping the lone =======$ trigger that false-positived on a 7-char setext underline /
  divider. Identical true-positive power (git writes all three markers); FP surface -> 0.
- /self-check: new harness.guard_selftest runs the matrix in an isolated temp repo (read-only
  vs the real tree) so guard correctness is continuously proven.

Verified 12/12 pass, true positives intact, real-tree FP surface = 0. FATAL flip (todo
f1c11d0d, on/after 2026-06-22) is now evidence-backed + one-step.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/scripts/harness-guard.sh

@@ -30,8 +30,12 @@ mapfile -t STAGED < <(git diff --cached --name-only --diff-filter=ACM 2>/dev/nul
 for f in "${STAGED[@]}"; do
     [ -n "$f" ] || continue
     blob=$(git show ":$f" 2>/dev/null) || continue
-    # 1. Conflict markers
-    if printf '%s\n' "$blob" | grep -qE '^(<<<<<<< |=======$|>>>>>>> )'; then
+    # 1. Conflict markers — require a REAL hunk: both an open (<<<<<<<) AND a close
+    #    (>>>>>>>) marker at line start. A lone '=======' line is a markdown setext
+    #    underline or a divider, not a conflict, so flagging it alone is a false positive
+    #    with no detection value (git always writes all three markers). Requiring the pair
+    #    eliminates that vector (verified by test-harness-guard.sh) before FATAL promotion.
+    if printf '%s\n' "$blob" | grep -qE '^<<<<<<< ' && printf '%s\n' "$blob" | grep -qE '^>>>>>>> '; then
         warn "conflict markers in staged file: $f"; ISSUES=$((ISSUES + 1))
     fi
     # 2. Unencrypted SOPS vault file