feat(review-tutor): choose a harness in the tutor page

[ElbertePlinio]

What changed

• #harness is populated from state.harnesses.filter(available) in registry order (Pi first, then Claude Code, Codex). It stays visible when only one harness is available.
• The helper line under it (#harness-helper, wired through aria-describedby) is the only explanation of the rest: "<n> harnesses available." when everything is available, the joined discovery reasons plus "Restart Pi to re-discover." when something is not, and the pinned "Pi is the only connected harness." with the flag off.
• #model / #thinking refill from the selected harness's models. The model chosen per harness is remembered in sessionStorage (reviewTutorModelByHarness) and the last harness in reviewTutorHarness, so switching back and reloading restore the selection; an unavailable remembered harness falls back to the default. A model id from another harness can no longer be produced by the page.
• Attribution: the answer header (#answer-attribution) and Learning log entry metadata read <Harness label> · <model label>, resolved by membership so model ids stay opaque to the page. A running answer keeps the identity it started with.
• Server (additive): GET /api/state harnesses[] entries carry models: ModelChoice[] ([] when unavailable). The flat models array is unchanged for rt/1 compatibility and the server-side membership check.
• The ask payload is unchanged — still modelId + thinkingLevel, still no harness key.

Flag stays default-off. No new components, no new tooling.

Tested

• npx vitest run packages/review-tutor/test — 344 passed (9 files), including new page tests for population and Pi default, helper strings for all three cases, model/thinking refill and per-harness memory, reload restore and fallback, no cross-harness leakage on ask, running-answer identity, and log attribution; harnesses[].models pinned in test/server-extension.test.ts.
• packages/review-tutor && npm run typecheck — clean.
• bun run check (typecheck, lint, test, coverage, build) — clean.

Not tested

• No captures at 1440 / 860 / 390: the package has no page render or screenshot helper, so there was nothing to drive them with.
• Cross-harness runtime proof (ask, cancel, quiz, log entry, export, reload during an answer, unauthenticated recovery, per connector) is manual and pending on Add isolated Claude Code and Codex connectors to Review Tutor #63; no real pi / claude / codex process was run here.
• Reloading while an answer is still running leaves the answer header attribution empty until the answer is saved: QuestionView carries no model id, and adding one is outside this contract.

Risk class

Serious user-facing.

Refs #63

[ElbertePlinio]

Ready for human review at b585f01 (stack: #76 → #77 → #78 → #80). Panel: Opus correctness (P2 saved-answer attribution test + P3s → fixed, mutation-verified; P2 adopted-answer attribution deferred to #79 — needs a protocol field), Grok security clean, Sonnet UI/a11y clean. Design acceptance (Fable, design lead): accepted — captures at 1440/860/390 flag on/off, live discovery of Pi + Claude Code + Codex on this machine. Flag stays default-off; local test switch: REVIEW_TUTOR_FLAGS=reviewTutorHarnessConnectors. CI green.