feat(loop): Phase 0-1 report-only Evidence-Gated Engineering Loop foundation

[brunovicco]

feat(loop): Phase 0-1 report-only Evidence-Gated Engineering Loop foundation

B2 - Minimal integration in this harness, nothing above 'report' autonomy:

• protect_sensitive_files.py (template and plugin): deny agent writes to
  '.loop/**' and 'scripts/loop_*', separate from the existing
  secrets denylist, with its own message pointing at docs/LOOPS.md. This
  is the mechanism that keeps loop_runner.py/loop_gate.py/loop_state.py
  and .loop/ contents from being silently built ahead of schedule; only a
  human editing outside of an agent tool call can populate them.
• template/scripts/_vendor_loop_schemas/: vendored copy of
  engineering-loop-schemas' src/loop_schemas/ (models.py,
  validate_contract.py) at commit 422a8c4, header-documented per file. The
  package is named vendor_loop_schemas (not loop_schemas) so it does not
  collide with its own scripts/loop* denylist; that is the one deviation
  from a verbatim vendor, documented in the header and in docs/LOOPS.md.
  Stdlib-only: no new dependency was added to the harness core (PyYAML is
  optional -- JSON contracts always work, YAML degrades gracefully with a
  clear error if PyYAML is not importable).
• template/scripts/validate_loop_contracts.py: discovers contracts under
  .loop/contracts/**, validates each with the vendored validator, and is
  a documented no-op when none exist (the expected state today). Wired
  into template/scripts/quality_gate.py as a new 'loop-contracts' check.
• docs/LOOPS.md: the three-tier model (agent/completion/operational), the
  eight final states, the non-negotiable principles, and this repo's
  current state (Phase 1, report-only).

B3 - Report-only self-evaluation workflow, in this harness only (no
changes to the sibling harness in this commit):

• scripts/loop_self_evaluation.py: renders every profile x governance
  combination into a temporary directory (discarded after the run), gates
  each with its own quality_gate.py, checks manifest/plugin/documentation
  consistency by delegating to tests.test_harness.DistributionTests, and
  writes a structured report.json + report.md. Zero repository
  modification; exit code reflects whether everything passed.
• .github/workflows/loop-self-evaluation.yml: workflow_dispatch (with a
  default-false 'run_agent_interpretation' input whose step is an inert,
  read-only placeholder defining no credentials) plus a weekly schedule.
  Uploads the report as a build artifact. Security: top-level
  'permissions: {}', explicit job-level 'contents: read' only,
  'persist-credentials: false', every action pinned by full commit SHA,
  no pull_request_target anywhere.

Out of scope, per the approved plan: no loop_runner.py, loop_gate.py,
loop_state.py, evaluator, or state machine; no autonomy above 'report'.

Validation: full 'uv run python -m unittest discover -s tests -v' (61
tests) passed; ruff check/format clean; mypy clean on the covered source
roots (scripts/loop_self_evaluation.py additionally checked standalone
with mypy --strict, clean; it is not yet in the repo-level mypy path,
which pre-dates this change and covers bootstrap.py/tests/template only);
scripts/quality_gate.py passed in full prior to this commit's final
additions, with every subsequent addition verified individually (ruff,
mypy, and the full test suite including the new, slower self-evaluation
end-to-end test) since the sandbox's command timeout could not host one
single >45s invocation of the full gate.