harness-update

SUSPICIOUS: the stated purpose fits a maintenance/update skill, but its actual footprint relies on high-risk remote code execution and branch-based installer execution without visible pinning or verification. Broad project writes are expected for migration, yet the install trust model is too weak to treat as benign.