refactor(config): finish harness posture split

[Hmbown]

Summary

• move the remaining built-in harness profile seeds and matching helpers into crates/config/src/harness.rs
• keep built_in_harness_profiles re-exported from the crate root so existing callers keep working
• preserve the behavior from the original [codex] refactor(config): extract harness posture module #3506 split while avoiding the stale draft conflicts

Harvested from PR #3506 by @Hmbown.
Refs #3311.

Verification

• cargo fmt --all --check
• cargo test -p codewhale-config --locked harness
• cargo test -p codewhale-config --locked
• git diff --check

[claude]

Claude finished @Hmbown's task in 1m 27s —— View job

---

Review: refactor(config): finish harness posture split

• Read changed files and diff
• Check cross-crate usages of moved functions
• Analyze correctness and invariant safety
• Compile review

---

Summary: Clean, correct refactor. Code is moved verbatim — no logic changes, no behavior delta. Module boundary is now sensibly cohesive.

---

What's good:

• built_in_harness_profiles, provider_routes_equal, wildcard_pattern_matches, and wildcard_chars_match all belong in harness.rs; having them split across lib.rs was the original debt.
• Re-export path (pub use harness::{..., built_in_harness_profiles}) is preserved so all existing callers (including the lib.rs:584 internal use in resolve_harness_profile) continue to compile without change.
• provider_routes_equal routes through ProviderKind::parse for normalized comparison — explicit route names from config, never inferred from model-string prefixes. Clean against the v0.8.65 EPIC v0.8.65 EPIC: Separate provider facts, model facts, offerings, and route resolution #2608 invariant.
• OnceLock initialization in built_in_harness_profiles is correct; lazy-static allocation is appropriate here.

One flag — missing test coverage (harness.rs has no #[cfg(test)] block at all):

The private helpers wildcard_chars_match / wildcard_pattern_matches carry all the pattern-matching logic for profile resolution, and provider_routes_equal depends on ProviderKind::parse behavior that may change. Moving these helpers into their own module is the right moment to lock in a few unit tests before the resolver is wired into runtime slices.

Minimum useful coverage:

• wildcard_pattern_matches: * matches everything, ? matches one char, deepseek-v4* matches/rejects correctly, empty-pattern edge cases.
• provider_routes_equal: known-kind pair normalizes correctly; unknown/freeform strings fall back to case-insensitive trim comparison.
• built_in_harness_profiles: profile count is stable, each seed passes matches_route against its own provider route and a representative model.

Not a blocker for landing (tests were absent before, behavior is unchanged), but worth a follow-up issue if not added here.

No correctness bugs, no provider-inference issues, no dead code introduced.