feat: instance manifest, tool profiles, metrics, and budget enforcement

Land HARNESS-WP-0001 T01/T02/T04/T05: extend ADR-005 schedule.yml with
harness fields, named tool-profile registry, ADR-004 metrics writes, and
BudgetTracker wiring. CLI gains validate/profiles; task-file path kept.

agent_harness/adapter.py

@@ -8,9 +8,7 @@ LLMAdapter interface so a hosted adapter can be swapped in later, and adds:
 
 - cwd pinned to the target repo
 - --permission-mode acceptEdits
-- an allow-list identical in spirit to binky-control/scripts/rhythm-session.sh:
-  read/edit tools plus local git add/commit/status/log/diff — no push, no
-  network, no arbitrary shell.
+- allow-list from a named tool profile (default: green-commit-only)
 """
 
 from __future__ import annotations
@@ -22,17 +20,30 @@ from llm_connect.claude_code import ClaudeCodeAdapter
 from llm_connect.exceptions import LLMSubprocessError, LLMTimeoutError
 from llm_connect.models import LLMResponse, RunConfig
 
-ALLOWED_TOOLS = (
-    "Read,Write,Edit,Glob,Grep,"
-    "Bash(git add:*),Bash(git commit:*),Bash(git status),"
-    "Bash(git log:*),Bash(git diff:*),Bash(date:*),Bash(ls:*)"
-)
+from agent_harness.profiles import ToolProfile, get_profile
+
+# Backward-compatible alias for the seed profile allow-list string.
+ALLOWED_TOOLS = get_profile("green-commit-only").allowed_tools
 
 
 class AgenticClaudeCodeAdapter(ClaudeCodeAdapter):
-    def __init__(self, workdir: Path, **kwargs):
+    def __init__(
+        self,
+        workdir: Path,
+        *,
+        tool_profile: str | ToolProfile = "green-commit-only",
+        **kwargs,
+    ):
         super().__init__(**kwargs)
         self._workdir = workdir
+        if isinstance(tool_profile, ToolProfile):
+            self._profile = tool_profile
+        else:
+            self._profile = get_profile(tool_profile)
+
+    @property
+    def tool_profile(self) -> ToolProfile:
+        return self._profile
 
     def _build_command(self, config: RunConfig) -> list[str]:
         cmd = [
@@ -41,7 +52,7 @@ class AgenticClaudeCodeAdapter(ClaudeCodeAdapter):
             "--permission-mode",
             "acceptEdits",
             "--allowedTools",
-            ALLOWED_TOOLS,
+            self._profile.allowed_tools,
         ]
         if self._model:
             cmd.extend(["--model", self._model])
@@ -70,7 +81,7 @@ class AgenticClaudeCodeAdapter(ClaudeCodeAdapter):
                 return_code=result.returncode,
                 stderr=result.stderr,
             )
-        return LLMResponse(
+        response = LLMResponse(
             content=result.stdout,
             model=self._model or "claude-code-cli",
             usage={},
@@ -79,5 +90,8 @@ class AgenticClaudeCodeAdapter(ClaudeCodeAdapter):
                 "provider": "claude-code-agentic",
                 "cli_path": self._cli_path,
                 "workdir": str(self._workdir),
+                "tool_profile": self._profile.name,
             },
         )
+        self._consume_budget(config, response)
+        return response