fix: unify Harness compatibility and release validation

[NanmiCoder]

Summary

Harness Alpha.5 and rc.1 removed the setup and delivery APIs used by AgentTeams 0.1.15. This change restores complete member execution through one audited compatibility boundary, preserving FIFO delivery, model/reasoning selection, fallback, failure handling and cold recovery on exact Alpha.2, Alpha.5 and rc.1 hosts.

Real-host tests also exposed and fixed lost fallback settings, a retry using the failed model snapshot, and an installed doctor bin that silently skipped execution through npm symlinks. Captain claims now require safe member reassignment, and both mutation routes enforce bounded JSON bodies behind the existing authentication gate.

The repository now includes the pinned community maintenance skills, a single compatibility policy, frozen host dependencies, an installation doctor, contribution/issue procedures and a publish gate that verifies and publishes the same package artifact. Prereleases use next; latest requires the recommended host and complete supported matrix.

Migration analysis and reproductions from #119, #124 and #130 are credited in the release notes. Nine independent contributions were already merged with their original authors. The dated maintenance report records the review of all 25 PRs and 41 issues, including remaining feature requests and incomplete reports.

Validation

• Node 24.20.0: typecheck, build and the complete verification suite passed.
• Real npm host cohorts: Alpha.2 (215 DSH packages), Alpha.5 (214), rc.1 (214); no mixed versions. Same candidate artifact passed 18 scenarios / 126 assertions covering FIFO, reasoning, fallback, failures, cold recovery and captain wakeup after yielding.
• Actual installed doctor bin passed on all three host/profile installations; HTTP authentication and oversized/unfinished request tests passed.
• Ego Browser: actual Web team execution, completion, model badges, panel resizing, collapse/reopen, docking and light/dark themes on Alpha.5 and rc.1.
• Real DeepSeek API: deepseek-official/deepseek-v4-flash completed the team workflow on all three hosts from /tmp (12 / 15 / 14 requests), including worker claims/updates, message delivery, captain wakeup and the independently verified result. An additional rc.1 Web run completed the same real-model workflow through browser input in the existing /tmp workspace. No credentials are included in evidence.
• Actionlint passed. CI passed all six gates: Ubuntu/Windows typecheck, build and full verify; three actual Ubuntu host cohorts; artifact/coverage aggregation. The Windows archive test now synchronizes release after observing a real OS lock rejection, eliminating a timing race while requiring a genuine retry. Native Desktop UI execution remains outside the evidence.

Candidate version: 0.1.16-rc.1, intended for next. This PR does not claim an npm release has occurred. Evidence and remaining limits are in docs/maintenance-2026-09-06/.