feat(harness): two-tier verify contract and stub canary

Wire check-stub-canary into verify.sh and declare integration: null
with hermetic_stop_only in profile disclosure.

Author: Sage Hart

.harness/profile.yaml

@@ -21,6 +21,7 @@ requires:
     stop: verify-on-stop
   commands:
     verify: ./scripts/verify.sh
+    integration: null
 bundles_applied:
   - cloud-guards
   - verify-on-stop
@@ -42,6 +43,8 @@ harness_disclosure:
     bundles_applied: []
     verify:
       cmd: ./scripts/verify.sh
+      integration_cmd: null
+      hermetic_stop_only: true
       stop_verify: project-verify-on-stop
       cloud_verify: null
     agents_md_lines: null

scripts/check-stub-canary.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# DO_NOT_DELETE_STUB_CANARY
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+if [[ -f scripts/verify.sh ]] && grep -q 'TODO: add real test' scripts/verify.sh; then
+  echo "STUB_CANARY: placeholder verify.sh" >&2
+  exit 1
+fi
+echo "check-stub-canary: ok"

scripts/verify.sh

@@ -4,6 +4,10 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$ROOT"
 
+if [[ -x ./scripts/check-stub-canary.sh ]]; then
+  ./scripts/check-stub-canary.sh
+fi
+
 if command -v corepack >/dev/null 2>&1; then
   corepack enable >/dev/null 2>&1 || true
   corepack prepare npm@10.9.2 --activate >/dev/null 2>&1 || true