refactor: move harness resources to .github/harness/

Move PR reviewer harness files into a dedicated .github/harness/ directory,
separate from the general .github/scripts/ used by Strands workflows.

- Move harness_review.py, prompts/ to .github/harness/
- Add Dockerfile for the harness container (dual-token: CLONE_TOKEN for
  git clones, GITHUB_TOKEN for gh CLI/PR comments)
- Add README documenting the harness directory
- Update pr-ai-review workflow to reference new path
- Update .prettierignore for new prompts location

Author: jesseturner21

.github/harness/Dockerfile

@@ -0,0 +1,32 @@
+FROM public.ecr.aws/docker/library/python:3.12-slim
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y \
+    git \
+    curl \
+    jq \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install GitHub CLI
+RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+    > /etc/apt/sources.list.d/github-cli.list \
+    && apt-get update \
+    && apt-get install -y gh \
+    && rm -rf /var/lib/apt/lists/*
+
+# Tokens are passed as build args only — not stored in env vars
+ARG CLONE_TOKEN
+ARG GITHUB_TOKEN
+
+# Configure git to use clone token for HTTPS clones
+RUN git config --global url."https://${CLONE_TOKEN}@github.com/".insteadOf "https://github.com/"
+
+# Persist gh CLI auth so GITHUB_TOKEN doesn't need to be in the environment
+RUN mkdir -p /root/.config/gh \
+    && echo "github.com:" > /root/.config/gh/hosts.yml \
+    && echo "  oauth_token: ${GITHUB_TOKEN}" >> /root/.config/gh/hosts.yml \
+    && echo "  user: agentcore-cli-automation" >> /root/.config/gh/hosts.yml \
+    && echo "  git_protocol: https" >> /root/.config/gh/hosts.yml
+
+WORKDIR /opt/workspace

.github/harness/README.md

@@ -0,0 +1,39 @@
+# Harness Resources
+
+Container and scripts for AI-powered automation via
+[AgentCore Harness](https://docs.aws.amazon.com/bedrock/latest/userguide/agentcore.html).
+
+## Structure
+
+```
+harness/
+├── Dockerfile            # Container image for the harness runtime
+├── harness_review.py     # Invokes the harness to review PRs (SigV4 + event stream)
+└── prompts/
+    ├── system.md         # System prompt (workspace context)
+    └── review.md         # PR review task prompt
+```
+
+## Current: PR Reviewer
+
+Reviews pull requests on open/reopen via `.github/workflows/pr-ai-review.yml`.
+
+### Dual-token setup
+
+The Dockerfile takes two build args:
+
+- **`CLONE_TOKEN`** — baked into git config for cloning private repos
+- **`GITHUB_TOKEN`** — baked into `gh` CLI auth for posting PR comments
+
+### Building the container
+
+```bash
+finch build \
+  --build-arg CLONE_TOKEN=<pat-for-cloning> \
+  --build-arg GITHUB_TOKEN=<pat-for-gh-api> \
+  -t pr-reviewer .github/harness/
+```
+
+## Future: Tester
+
+This directory will also house a harness-based test runner.

.github/scripts/python/harness_review.py .github/harness/harness_review.py.github/scripts/python/harness_review.py renamed to .github/harness/harness_review.py

@@ -25,7 +25,7 @@
 DIM = "\033[2m"
 RESET = "\033[0m"
 
-SCRIPTS_DIR = os.path.join(os.path.dirname(__file__), "..")
+SCRIPTS_DIR = os.path.dirname(__file__)
 
 
 def read_prompt(filename):

.github/scripts/prompts/review.md .github/harness/prompts/review.md.github/scripts/prompts/review.md renamed to .github/harness/prompts/review.md

@@ -139,7 +139,7 @@ jobs:
         env:
           PR_URL: ${{ steps.pr-url.outputs.url }}
           HARNESS_ARN: ${{ secrets.HARNESS_ARN }}
-        run: python .github/scripts/python/harness_review.py
+        run: python .github/harness/harness_review.py
 
       - name: Remove agentcore-harness-reviewing label
         if: always()

.github/scripts/prompts/system.md .github/harness/prompts/system.md.github/scripts/prompts/system.md renamed to .github/harness/prompts/system.md

@@ -1,3 +1,3 @@
 CHANGELOG.md
 src/assets/**/*.md
-.github/scripts/prompts/
+.github/harness/prompts/