fix(harness): add automatic TaskCompleted producer (B3, partial)

POST /v1/harness/complete lets a Claude Code Stop hook report task
completion instead of relying on a human hitting the manual endpoint.
The hook only fires on an explicit .orchestra-report.md marker (not
every turn boundary); the server builds the receipt itself from the
real transcript via herdr.ClaudeUsage rather than trusting a
self-reported number. Codex/opencode producers and the turn-decision
endpoint are still unbuilt — see AUDIT.md/progress.md for scope.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W1rkJ2hBMybnJctPbcy4tT

deploy/hooks/orchestra-stop.sh

@@ -0,0 +1,48 @@
+#!/bin/sh
+# Claude Code Stop hook — fires on every turn boundary, not just completion.
+# Convention: the agent signals "this task is done" by writing a report file
+# named .orchestra-report.md at the worktree root before stopping. If that
+# marker is absent, this is an ordinary turn boundary and the hook is a
+# no-op — do not treat every stop as completion (AUDIT.md B3).
+#
+# Requires: ORCHESTRA_TASK_ID and ORCHESTRA_URL set in the pane's env.
+# Optional: ORCHESTRA_HARNESS_TOKEN if the server requires one.
+#
+# Reads the Stop hook's JSON payload from stdin (has "transcript_path" and
+# "cwd"); needs jq.
+
+set -eu
+
+payload="$(cat)"
+transcript_path="$(printf '%s' "$payload" | jq -r '.transcript_path // empty')"
+cwd="$(printf '%s' "$payload" | jq -r '.cwd // empty')"
+
+[ -z "$transcript_path" ] && exit 0
+[ -z "${ORCHESTRA_TASK_ID:-}" ] && exit 0
+[ -z "${ORCHESTRA_URL:-}" ] && exit 0
+
+report_file="${cwd:-.}/.orchestra-report.md"
+[ -f "$report_file" ] || exit 0
+
+report="$(cat "$report_file")"
+
+auth_header=""
+if [ -n "${ORCHESTRA_HARNESS_TOKEN:-}" ]; then
+	auth_header="Authorization: Bearer ${ORCHESTRA_HARNESS_TOKEN}"
+fi
+
+body="$(jq -n \
+	--arg task_id "$ORCHESTRA_TASK_ID" \
+	--arg transcript_path "$transcript_path" \
+	--arg report "$report" \
+	'{task_id: $task_id, transcript_path: $transcript_path, report: $report}')"
+
+if curl -fsS -X POST "${ORCHESTRA_URL%/}/v1/harness/complete" \
+	-H "Content-Type: application/json" \
+	${auth_header:+-H "$auth_header"} \
+	-d "$body" >/dev/null 2>&1; then
+	rm -f "$report_file"
+else
+	echo "orchestra-stop: failed to report completion" >&2
+	exit 2
+fi