CLI-first Harness Engineering for AI agents — content-addressed, signed, reversible. Public design, private core.