feat: add pinned cross-repo Developer OS kernel harness v3

[Mopati123]

Purpose

Complete the first cross-repository Developer OS bridge by invoking the separately certified HPL Agentic Runner from codebase-prompting.

Behavior

The harness:

• requires an explicit kernel checkout path;
• verifies the checkout is an ordinary git worktree;
• requires exact kernel HEAD a5d2d913e41fd9a80212825921d0919fd8320b3b;
• invokes python -m hpl.runtime.agentic_runner as a separate process;
• defaults to admission-only;
• requires explicit execution request before passing --execute;
• emits a deterministic harness receipt.

Authority boundary

The harness does not import kernel internals, mint tokens, or bypass HPL.

Even when --execute is requested, the kernel runner must still admit the binding and mint an HPL ExecutionToken before RuntimeEngine can execute.

Environment boundary

This layer does not inject OpenHands credentials, endpoints, or secret configuration. Operator environment remains external.

Truth boundary

CI mocks the subprocess boundary. It proves exact-kernel pinning, command construction, admission-only default behavior, and explicit execute semantics. It does not perform a live OpenHands effect.

Review order

This PR is stacked on certified Developer OS v2 and remains draft until CI passes.

Certified Phase N v3 baseline

At head 2944366b3664f2cd3b36ff0e55291b0f820cc127, the dedicated Repository Intelligence CI completed successfully.

Certified v3 additions:

• pinned cross-repository kernel checkout verification;
• exact certified kernel runner HEAD requirement;
• separate-process invocation of hpl.runtime.agentic_runner;
• admission-only default behavior;
• explicit --execute boundary;
• deterministic harness receipt;
• no token minting or authority bypass in codebase-prompting.

Truth boundary: CI certifies the harness contract with a mocked subprocess boundary. It does not yet prove a live local cross-repository HPL admission or any OpenHands network effect.

This commit is the certified Phase N v3 contract baseline. PR remains draft and unmerged.