feat(harness): sync Hardware Council, /mode, security patterns, sync pipeline from molt

[rdemeritt]

Summary

Brings the public freelance-developer-harness up to parity with generic improvements that have organically accumulated in the private molt-and-deploy-harness. All content is sanitized — no client workspaces, no personal paths, no auto-memory.

What landed

• Hardware Council — 9 new agents (hardware-pm, industrial-designer, electrical-engineer, firmware-engineer, mechanical-engineer, hardware-security-engineer, manufacturing-engineer, supply-chain-specialist, certification-specialist)
• Updated product-manager agent — hardware NPI pipeline, cross-council coordination contracts, project classification (software/hardware/hybrid)
• /mode command — session-scoped permission control (plan/auto/safe/bypass)
• patterns/security/ — 5 reusable patterns (filesystem-sandboxing, llm-code-ast-validation, prompt-injection-sentinel, security-gated-feature-flag, wiring-test)
• CLAUDE.md — Hardware Council block, NPI pipeline, cross-council contracts, project classification (Active Clients table preserved as public template — no PII)
• scripts/sync-to-public.sh — repeatable molt -> public sync (allowlist + blocklist + path scrubber + Active Clients reset + dry-run)
• .github/workflows/pii-check.yml — CI guard that fails on /Users/, clients/self, or rdemeritt in any committed file

Hard rules followed

• Source molt repo never modified (read-only)
• No novel template included (lives in its own repo)
• Active Clients table reset to single template row
• Local PII sweep passed before commit (CI will verify on push)

Test plan

• CI pii-check job passes (the gate this PR also installs)
• sync-to-public.sh --dry-run runs without error against a fresh checkout
• Spot-check .claude/agents/hardware-pm.md contains no personal paths
• CLAUDE.md Active Clients table contains only the _template and your-client placeholder rows
• Spawn a hardware specialist agent (e.g., firmware-engineer) in a clean Claude Code session and confirm it loads