[harness] Add factory onboarding guide, shared settings, and spec/ dir

Purdue-branded getting-started.html (AA-safe, dark+light); least-privilege .agents/settings.json allowlist; spec/README.md describing per-job design records.

Author: glentner