fix(ci): run the harness from a snapshot so a skill that syncs harness-adapter cannot break its own run

[aaronjmars]

Problem

aeon-update on aeon-agent went red on 2026-10-05 (run https://github.com/aaronjmars/aeon-agent/actions/runs/37300267512):

provider 'claude' failed - ... harness-adapter/run-harness: line 189: unexpected EOF while looking for matching `"'
All gateway providers failed (claude glm)

bash reads a script as it executes it. aeon-update syncs upstream files into the workspace while the skill runs, and that sync changed harness-adapter/run-harness (531f575..1a7f07e touched it). When the agent exited, the running run-harness (and the running adapter) kept reading a file that had changed under them and hit a parse error. The gateway cascade read that as a provider failure and re-ran the whole skill on the next provider, which also failed. The sync PR was still opened, but the run is red and the skill ran twice.

Fix

New scripts/harness-adapter-snapshot.sh copies harness-adapter/ to $HOME/.aeon-run/harness-adapter right before the run and prints the copy's run-harness; aeon.yml calls it as RH=$(bash scripts/harness-adapter-snapshot.sh). Nothing in harness-adapter/ refers to paths outside its own folder, so the copy behaves the same. The logic lives in a script because the Run step is close to GitHub's 21000-character run: limit (test_workflow_harness_choices.sh guards at 20500); the step is now 20331, 6 under main.

$HOME and not $RUNNER_TEMP or /tmp: those are writable inside the read-only bwrap sandbox, and the unsandboxed scorer step runs this same copy. $HOME itself stays read-only there (only ~/.claude, ~/.cache, ~/.npm and the other harness state dirs are writable).

Checks

• actionlint: same findings as main, none new. shellcheck clean; scripts/lint-shell.sh OK.
• scripts/tests/test_workflow_harness_choices.sh: passes (Run step 20331 characters).
• scripts/tests/test_dry_run_dispatch.sh: 38 passed. scripts/tests/test_readonly_notify.sh: all pass.