feat: bug-verify-sonnet@1 template + planning-sonnet-repo runtime

Adds the CRS-side deliverables for agent-runtimes work item f59f0132
(ai-resolve bug-verification stage, M42 concept 7666d278). Mirrors
planning-opus-repo's layer stack with the sonnet model applied at the
node level (model: sonnet), per the established convention that the
composite name is descriptive only — the workflow node's own model:/
tier: field is what actually selects the model.

The template's terminal node runs the (separately-tracked, sibling
task ad975ac6) state-tx-verdict script — this template will not be
runnable end-to-end until that script lands, but the declarative
config itself is independently valid: schema-validates cleanly and
both eligibility scenarios from the task spec pass (verify-pending +
ai-resolve -> ok=True; missing flow_state -> state_mismatch).

harnesses/composites/planning-sonnet-repo/v1/harness.yaml

@@ -0,0 +1,10 @@
+kind: composite
+name: planning-sonnet-repo
+version: 1
+description: "Planning agent with Sonnet + repo clone via SSH"
+
+layers:
+  - context: planning/v1
+  - context: anthropic-cloud-paul-oauth/v1
+  - context: gitea-ssh/v1
+  - context: agent-repo/v1