feat(resolve): add runtime fetch schema and ResolveSkillURL (Phase 4 PR 1)

[ggallen]

Summary

• Add allow_runtime_fetch and max_runtime_fetches fields to the harness schema with validation (negative max rejected, max without allow rejected, backward-compatible defaults)
• Export ResolveSkillURL in internal/resolve/ for single-URL runtime skill resolution — reuses existing fetch/cache/integrity/SSRF infrastructure with FetchType: "runtime" audit logging
• Add Phase 3 (backfill) and Phase 4 implementation plan docs; update Phase 1/2 plans with cross-references

This is PR 1 of 3 for Phase 4 (Runtime Dependency Loading) of ADR-0038. PR 2 adds the in-sandbox fullsend-fetch-skill script; PR 3 wires the runtime fetch handler into fullsend run.

Test plan

• make go-test — all pass (5 new harness validation tests, 9 new ResolveSkillURL tests)
• make lint — clean
• Verify backward compatibility: harness without new fields loads and validates identically
• Verify ResolveSkillURL paths: valid fetch, cache hit, hash mismatch, allowlist rejection, missing hash, non-HTTPS rejection, audit entry, offline miss/hit

🤖 Generated with Claude Code

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:12 AM UTC · Completed 12:23 AM UTC
Commit: 4ed6da4 · View workflow run →

[fullsend-ai-review]

Review skipped — this PR is already closed.

The /fs-review command only reviews open pull requests.

_{Posted by fullsend pre-review check}

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 12:12 AM UTC · Completed 12:17 AM UTC
Commit: 4ed6da4 · View workflow run →

[fullsend-ai-retro]

PR #2103 was a human-authored PR opened and closed within 26 seconds (likely reopened as PR #2104). The review agent was dispatched but correctly detected the closed state and skipped. This retro run itself is an example of unnecessary dispatch — no agent involvement, no review, no merge.

All improvement opportunities identified are already covered by existing open issues:

• Skip retro dispatch on PRs with no agent involvement #939 / Skip retro dispatch for unmerged PRs with no agent interaction #1411 / Extend retro skip guard to human-authored PRs with no-finding reviews #1675: Skip retro dispatch on PRs with no agent involvement or no meaningful review findings
• Skip review/fix dispatch when PR action is 'closed' #1870 / Skip review dispatch when PR is already closed or merged #1439: Skip review/fix dispatch when PR action is 'closed' or PR is already closed

No new proposals are warranted. The existing issues, once implemented, would prevent both the unnecessary review dispatch and this retro run from occurring.

[fullsend-ai-review]

Review skipped — this PR is already closed.

The /fs-review command only reviews open pull requests.

_{Posted by fullsend post-review check}