feat: add Claude Code harness setup and diagnostics

[Sayt-0]

Summary

• Add an interactive Claude Code harness setup path backed by the official claude CLI and its existing Claude subscription login.
• Diagnose Claude Code installation and authentication when an agent configuration uses a claude-code harness.
• Document harness model selection, effort levels, authentication inheritance, limitations, and security behavior.

Changes

Area	Details
Setup	Add a fourth docker agent setup path for Claude Code, with an optional model override, configurable effort, explicit login confirmation, and generation of claude-code-agent.yaml.
Doctor	Check Claude Code installation, version, and safe authentication metadata only when the supplied configuration declares a claude-code harness.
Configuration	Accept xhigh for Claude Code harness effort across config versions v9, v10, v11, latest, and the JSON schema.
Harness-only configs	Do not require an unrelated provider API key or Docker Model Runner when every agent delegates to an external coding harness.
Documentation	Cover root and sub-agent usage, login inheritance, model defaults, effort configuration, toolset limitations, and permission behavior.

Security

• Invoke the Claude CLI directly without a shell.
• Never read, copy, print, or store Claude credentials.
• Retain only non-identifying authentication metadata from claude auth status --json.
• Run claude auth login --claudeai only after explicit confirmation.
• Warn that the current harness uses --dangerously-skip-permissions.
• Recommend an isolated git worktree for harness runs.
• Clarify that Docker Agent sandbox mode does not automatically carry the host Claude CLI or its login.

Validation

• go build ./...
• go test ./... -count=1
• golangci-lint run
• go run ./lint .
• Hugo documentation build
• Real docker agent doctor smoke test with an authenticated Claude Code CLI

The full test suite passes with proxy environment variables unset. The documentation link checker still reports pre-existing external 403/404 responses and an unrelated existing MCP anchor.