[Issacboy123]

Summary

Diffex needs a stable representation for evolvable harness configuration before consumers or evolution workflows can operate on it. This PR adds a private harness-state package that persists the system prompt as a validated portable directory bundle, identifies its exact content with derived SHA-256 metadata, and provides the canonical clean-default state.

Reasoning

Keeping the schema and persistence contract in a dedicated private package gives future consumers one runtime-validated ownership boundary without coupling storage to the coding agent. A content hash identifies and verifies the stored prompt without introducing a numerical schema version that does not represent the harness content. The algorithm-prefixed digest leaves the metadata self-describing, while the strict two-file layout, sibling staging, and final rename keep bundles inspectable and prevent normal saves from exposing partial destinations.

Changes

• Added the private @diffexai/diffex-harness-state ESM workspace package with strict TypeBox schemas and inferred readonly state and manifest types.
• Added SHA-256 manifest metadata derived from the exact EVOLVE.md bytes, with automatic generation during saves and verification during loads.
• Added bundle loading that enforces an exact direct-file layout, fatal BOM-free UTF-8, strict manifest validation, and verbatim system-prompt preservation.
• Added non-overwriting bundle saves through an owned sibling staging directory, canonical content-hash manifest serialization, a second destination check, final rename, and best-effort staging cleanup on failure.
• Added a checked-in clean-default bundle and routed default loading through the same validation path as external bundles.
• Added package documentation and root build, offline-build, type-check path, and lockfile integration without adding publication or runtime-consumer integration.
• Added focused coverage for schemas, content-hash integrity, default bytes, round trips, invalid encodings and manifests, filesystem layouts, overwrite refusal, cleanup, and partial-destination prevention.

Testing

• node ../../node_modules/vitest/dist/cli.js --run test/harness-state.test.ts
• npm run check