#1197 Report the retired harnesses: frontmatter key from validate

[williamthorsen]

What

codeassembly validate now reports every skill whose frontmatter still declares the retired harnesses: key instead of supported-harnesses:, and exits non-zero.

This is a safeguard for the recent retirement of the old key. Use of the old key in a skill's declaration would have silently deployed to every harness.

Why

The rename to supported-harnesses: left the bare harnesses: key as valid YAML that nothing reads. A skill still carrying it loses its harness narrowing and ships the dead key into every harness's installed copy, and neither failure raises anything anywhere — the author's only signal is noticing the skill somewhere it should not be. codeassembly.yaml uses harnesses: as a real key of its own, so the confusable write is easy to reach for.

Details

🎉 Features

• validateContentRoot gains a harness-independent pass over every skill the content root owns, carried by a new frontmatter defect kind. The report names the offending file and the key to rename to, and rides the command's existing non-zero exit.
• The check is value-blind: a bare harnesses:, a scalar, and a list all report, since the key's presence is what survives into deployed output regardless of what it holds.
• Skills resolved from the built-in library are skipped. Their content-root-relative path would name a file the root does not carry, and renaming a library skill is not its consumer's to do.
• The pass reads frontmatter through the same parseFrontmatter → parseYaml composition the deploy path uses, so validate sees exactly the frontmatter readTargetHarnesses sees.

🧪 Tests

• Four cases over the pass: a root skill declaring the retired key reports; a skill declaring both keys still reports, so a half-finished rename is not masked; a skill on the current key alone stays clean; and a library skill declaring the retired key, reached through a real dependencies: edge, stays silent. The last fails if the ownership filter is removed.
• The writeSkill fixture helper gains a retiredHarnesses option that emits the retired key.

📚 Documentation

• validate was described as checking for defects that would fail at a consumer. That was true of every pass it had; this one reports a defect that fails nowhere. Four sites now say "defects that reach a consumer" — the CLI tables in AGENTS.md and the package README, plus the CLI's own --help text.
• The package README and the validateContentRoot doc comment each account for the pass that has no sync counterpart, naming what it catches and why nothing else would.

Closes #1197

[github-actions]

Dependency audit

Production dependency audit passed.