fix(harbor): align task schema, safe staging, and judge status

[reacher-z]

Summary

This PR hardens the existing Harbor integration without changing the native runner contract.

• Emit Harbor task schema 1.4, centralized in HARBOR_SCHEMA_VERSION, matching Harbor 0.22.x task templates.
• Reuse native extra_info normalization/path validation and fail fast on path escapes, missing files, non-files, and basename collisions instead of silently skipping or overwriting staged files.
• Preserve Harbor judge infrastructure failures and unparseable verdicts as judge_status = "inconclusive", failure_category = "judge_inconclusive", and numeric judge_inconclusive = 1 in reward.json.
• Add regression tests for schema generation, staging safety, judge status, and the Harbor verifier metric contract.
• Add the Chinese codebase evaluation report with Harbor-first findings, prioritized risks, maintainer questions, and the follow-up issue map.
• Update Harbor documentation and CHANGELOG.md.

Related to #331. The real Docker smoke gate remains tracked in #350; security and policy follow-ups are #349, #351, and #352.

Verification

• uv run --frozen pytest -q -> 288 passed, 3 skipped
• uv run --with harbor==0.22.0 pytest tests/test_harbor_version_compatibility.py -q -> 2 passed
• uv run --frozen ruff check .
• uv run --frozen ruff format --check .
• uv run --frozen pyright
• Markdown link check -> all 162 repo-relative links resolve
• uv build plus twine check -> wheel and sdist passed

Docker is not installed in the local environment, so this PR does not claim to provide a Harbor container E2E result; #350 is the requested CI gate for that coverage.

@Perry2004 please review the Harbor schema/version contract and the result semantics, especially whether judge_inconclusive should be promoted into Harbor's aggregate status in the follow-up CI work.