refactor(policy)!: remove NetworkBinary harness field

[varshaprasad96]

Summary

Remove the deprecated NetworkBinary.harness field before 0.1.0 while preserving advisor-origin provenance at the endpoint/rule boundary.

Related Issue

Closes #3054

Changes

• Reserve protobuf field number 2 and name harness, update generated Go bindings, and remove runtime, SDK, and profile uses.
• Reject legacy YAML/profile harness input with migration guidance while retaining protobuf wire compatibility.
• Move advisor provenance enforcement to gateway-stamped endpoints and keep advisor binaries separated from explicit rules, including rule-name collisions.
• Migrate legacy stored policy-history provenance without dropping unknown nested wire fields.
• Update policy architecture, provider profile docs, and 0.1.0 migration notes.

Testing

• mise run pre-commit
• cargo test --workspace --exclude openshell-server -q
• cargo test -p openshell-server --lib -q
• cargo test -p openshell-supervisor-network --lib -q
• cargo test -p openshell-sandbox --lib -q
• mise run go:ci
• mise run sdk:ts:ci
• mise run test:python
• Focused policy/profile/protobuf migration and provenance regressions.
• mise run e2e:docker — blocked before execution because the local Docker daemon was unreachable.

Checklist

• Implementation is scoped to refactor(policy)!: remove deprecated NetworkBinary.harness #3054.
• Tests and pre-commit checks pass.
• Documentation and migration guidance are updated.
• Commit is signed off for DCO.
• Docker-backed E2E completed (local Docker daemon unavailable).

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.