feat: instance manifest, tool profiles, metrics, and budget enforcement

Land HARNESS-WP-0001 T01/T02/T04/T05: extend ADR-005 schedule.yml with
harness fields, named tool-profile registry, ADR-004 metrics writes, and
BudgetTracker wiring. CLI gains validate/profiles; task-file path kept.

README.md

@@ -11,16 +11,30 @@ OpenBao/ops-warden, reporting to the Custodian State Hub.
   [docs/architecture.md](docs/architecture.md)
 - Current work: [workplans/](workplans/)
 
-## Usage (prototype)
+## Usage
 
 ```
-agent-harness run --task-file examples/task-hello-sandbox.json [--no-hub]
+# Validate a consuming repo's instance manifest (.kaizen/schedule.yml)
+agent-harness validate --target ~/binky-control
+agent-harness validate --target ~/binky-control --strict   # require harness fields
+
+# List named tool profiles
+agent-harness profiles
+
+# Run exactly one task (local JSON task-file path)
+agent-harness run --task-file examples/task-hello-sandbox.json [--no-hub] [--no-metrics]
+
+# Deterministic mailbox scan (no LLM session)
 agent-harness mail-scan --target-repo ~/binky-control
 ```
 
-Runs exactly one task per invocation: persona bundle
-(`kaizen-agentic schedule prepare`) → bounded agentic session
-(cwd-pinned, hard tool allow-list, never pushes) → commit verification →
-State Hub progress event + task close.
+Each `run` resolves the agent's tool profile + budget from the target
+repo's instance manifest (default `green-commit-only`), loads a persona
+bundle (`kaizen-agentic schedule prepare`), runs a bounded agentic
+session (cwd-pinned, hard allow-list, never pushes), verifies a local
+commit, writes `.kaizen/metrics`, and posts a State Hub progress event.
+
+Instance manifest contract: [docs/instance-manifest.md](docs/instance-manifest.md).
+Example: [examples/schedule.harness.yml](examples/schedule.harness.yml).
 
 Tests: `PYTHONPATH=".:$HOME/llm-connect" python3 -m pytest tests/ -q`