Add write-once probe loop kill guard to prevent 15-min agent timeout

[Copilot]

Reviewer workflows (PR Code Quality Reviewer, Impeccable Skills Reviewer, Matt Pocock Skills Reviewer) were hitting the 15-minute step hard timeout at a rate of 10/22 red runs in 6h. Root cause: the Copilot CLI agent enters an infinite probe loop — repeatedly calling write-once safe-output tools with empty arguments, receiving -32602 rejections, and never exiting.

Changes

harness_retry_guard.cjs — detection primitives

• WRITE_ONCE_PROBE_REJECTION_PATTERN / WRITE_ONCE_PROBE_REJECTION_THRESHOLD (3)
• countWriteOnceProbeRejections(output) — counts occurrences of the rejection phrase in accumulated output
• hasExcessiveWriteOnceProbeRejections(output) — true when count ≥ threshold

process_runner.cjs — live kill guard

• Added optional killGuard?: (output: string) => boolean to runProcess. Called after each stdout/stderr data chunk; fires SIGTERM the first time it returns true. Prevents any loop from burning the full step timeout.

copilot_harness.cjs — wiring

• Passes a killGuard to runProcess that fires on 3+ probe rejections in live output
• Post-exit: detects the pattern, emits infrastructure_incomplete, breaks the retry loop (non-retryable — retrying would reproduce the same loop)
• New "write_once_probe_loop" failure class in classifyCopilotFailure

// Before: agent hangs for 15 min, killed by Actions timeout
// After: harness detects 3rd rejection, sends SIGTERM, emits structured diagnostic

[copilot-harness] kill-guard fired — terminating process (SIGTERM)
[copilot-harness] attempt 1: excessive write-once probe rejections detected
  (count=3, threshold=3) — not retrying (agent probe loop terminated)

Tests

• 11 new tests in harness_retry_guard.test.cjs covering count/threshold/false-positive cases
• 3 new tests in process_runner.test.cjs covering kill-guard fire, no-op, and single-fire semantics