chore: sync framework content from agent-runtimes main (2026-04-28)

- Hardens qwen-code-methodology rules (no code deletion, pre-commit diff)
- Fixes test-writing CLAUDE.md workspace path
- Adds best-practices-opus-repo/v1 composite harness
- Adds opus-best-practices-review task template
- Adds max_turns support to airouter task template defaults
- Updates agent-repo finalize.sh

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

task-templates/opus-best-practices-review.yaml

@@ -0,0 +1,17 @@
+name: opus-best-practices-review
+description: "Opus best practices review agent — review specs and code against project best practices"
+model: opus
+harness: security-review-opus-repo/v1
+requires_tags: [claude-code, best-practices, git-access, project-repo]
+required_params: [repo_url, agent_repo_url]
+defaults:
+  timeout: 3600
+pre_actions:
+  - type: clone
+    repo: "{{ repo_url }}"
+    branch: main
+    depth: 1
+blocked_combinations:
+  - field: on_success
+    contains_type: commit_pr
+    message: "Use agent_repo instead of commit_pr — avoids F77 SSH alias URL bug"