feat: harness-audit workflow + expanded language rules

[5uck1ess]

Summary

• New harness-audit workflow + skill — audits the agent harness config itself (CLAUDE.md, hooks, MCP configs, agent definitions, permissions) for misconfigurations, injection risks, and security gaps. Inspired by ECC's AgentShield concept but engine-driven.
• New common.md rules — cross-platform, language-agnostic rules (paths, temp dirs, line endings, assumption-surfacing, error messages). Applied via **/* glob to all files.
• 4 new language rule sets — java, kotlin, swift, csharp. Follow existing pattern (YAML frontmatter with path globs, one-liner bullets).
• CLAUDE.md convention — added "state assumptions before implementing" to Conventions section. Updated layout table to reflect expanded rules.

Motivated by comparison with everything-claude-code — took the ideas worth adapting to our deterministic architecture, left the rest.

Changelog

Added

• harness-audit workflow + skill — audits agent harness configuration (CLAUDE.md, hooks, MCP configs, agent definitions, permissions) for misconfigurations, injection risks, and security gaps
• common.md language-agnostic coding rules — cross-platform paths, temp dirs, assumption-surfacing, error messages (applied via **/* glob)
• java, kotlin, swift, csharp language rule sets — following existing pattern with path-gated activation

Changed

• CLAUDE.md: added "state assumptions before implementing" convention, expanded rules listing in layout table
• README.md: added 6 new entries to coding rules table, bumped skill count to 39
• ROADMAP.md: bumped to 39 skills / 22 workflows

Test plan

• devkit workflow list shows harness-audit
• /devkit:harness-audit runs through all 3 steps (inventory → analyze → report)
• /devkit:setup-rules installs all 10 rule files to ~/.claude/rules/
• Existing workflows unaffected (no changes to engine or existing YAML)
• Rule paths: globs activate correctly per language
• No Windows-breaking shell commands in new files (all prompt-driven, no test -f etc.)