feat: bug-verify-sonnet@1 template + planning-sonnet-repo runtime

Adds the CRS-side deliverables for agent-runtimes work item f59f0132
(ai-resolve bug-verification stage, M42 concept 7666d278). Mirrors
planning-opus-repo's layer stack with the sonnet model applied at the
node level (model: sonnet), per the established convention that the
composite name is descriptive only — the workflow node's own model:/
tier: field is what actually selects the model.

The template's terminal node runs the (separately-tracked, sibling
task ad975ac6) state-tx-verdict script — this template will not be
runnable end-to-end until that script lands, but the declarative
config itself is independently valid: schema-validates cleanly and
both eligibility scenarios from the task spec pass (verify-pending +
ai-resolve -> ok=True; missing flow_state -> state_mismatch).

harnesses/composites/planning-sonnet-repo/v1/harness.yaml

@@ -0,0 +1,10 @@
+kind: composite
+name: planning-sonnet-repo
+version: 1
+description: "Planning agent with Sonnet + repo clone via SSH"
+
+layers:
+  - context: planning/v1
+  - context: anthropic-cloud-paul-oauth/v1
+  - context: gitea-ssh/v1
+  - context: agent-repo/v1

task-templates/workflow/bug-verify-sonnet@1.yaml

@@ -0,0 +1,61 @@
+name: bug-verify-sonnet
+version: 1
+description: Read-only verification of an ai-resolve-tagged bug using Sonnet planning
+runtime: planning-sonnet-repo
+input:
+  state: verify-pending
+  tags_required: [ai-resolve]
+  tags_forbidden: []
+  required_artifacts: []
+output:
+  state: 'verified|rejected'
+scope_budget:
+  files_modified_max: 1
+  lines_diff_max: 400
+  wall_clock_seconds_max: 1800
+nodes:
+  - id: agent
+    kind: agent
+    template: planning-sonnet-repo
+    model: sonnet
+    runtime_env:
+      AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_BRANCH: "bug-verify/${item.uuid}"
+    prompt: |
+      The agent-runtimes project repo is cloned at /workspace/project.
+      Change to that directory before doing any work.
+
+      Verify the following bug report. This is a READ-ONLY investigation —
+      do NOT modify any source code. Your only file changes are the
+      verification artifact described below.
+
+      **Title**: ${item.title}
+
+      **Bug report**:
+      ${item.body}
+
+      Steps:
+      1. cd /workspace/project
+      2. Investigate the codebase to determine whether the reported bug is
+         real, reproducible, and correctly diagnosed. Do not make code
+         changes — this is verification, not a fix.
+      3. Write your findings to
+         spec/bugs/<slug>-verification.md (derive <slug> from this item's
+         own slug) with exactly these sections, in order:
+         - `## Reproduction` — concrete steps or evidence confirming (or
+           failing to confirm) the reported symptom
+         - `## Root-Cause Hypothesis` — the mechanism you believe causes it,
+           with file/line references
+         - `## Verdict` — exactly one of `verified` or `rejected`
+         - `## Rationale` — why you reached that verdict
+      4. Commit and push the verification artifact on this branch.
+      5. Write the bare verdict token — exactly `verified` or exactly
+         `rejected`, nothing else, no trailing whitespace or punctuation —
+         to /workspace/verdict. This file is NOT committed to the repo.
+      6. Call task_complete.
+  - id: verdict-tx
+    kind: script
+    cmd: scripts/workflow/state-tx-verdict
+    depends_on: [agent]
+    runtime_env:
+      STATE_TX_ALLOWED_STATES: "verified,rejected"