Epic: ADR 0061 — per-repo harness CEL dispatch

[ifireball]

What is missing

ADR 0061 adopts CEL trigger expressions on harness files and routing through fullsend dispatch, but per-repo installations still route all default agents through bash logic in reusable-dispatch.yml. Custom agents still require per-agent workflow files and dispatch bash edits (#1985).

What should happen

Per-repo dispatch is implemented in vertical slices:

1. Custom agents first — harness-dispatch job + fullsend dispatch (ADR 0054 authorization, kill switch, CEL matching) without modifying the existing bash route job.
2. Behaviour baseline per default agent — dispatch trigger scenarios on the current bash router (dummy runtime) before porting that agent.
3. Port default agents one at a time — move each agent's trigger logic to harness CEL; agent-specific gating and possible ADR/harness extensions decided per agent.
4. Cutover — remove bash routing when all agents are ported.

Out of scope: org-mode dispatch.yml.

Implementation plan

Sub-issues track each PR. Principles:

• Vertical slices (code + tests in the same PR)
• Lint co-located with trigger: field and each agent's expression
• No changes to bash route until the cutover issue
• Denied dispatch → empty matrix (no structured deny output for now)
• roles: config check — decide per agent during port, not in the initial custom-agent slice

Related

• ADR 0061
• NormalizedEvent v1
• ADR 0058 agent registration
• ADR 0054 authorization
• Closes/supersedes direction in #1985, #2565 when complete
• Behaviour framework: PR #1982