arch: narrow harness/index.ts exports to public session roles

[cursor]

Problem

`architecture.md` defines five public session-domain roles and marks `session.ts`, `session-fold.ts`, and `session-repository.ts` as private collaborators. `packages/server/src/harness/index.ts` correctly withholds those, but still re-exports low-level internals:

• `executable`, `queue-stream`, `session-io`, `probe`, `list`

External callers (via `../harness` barrel) can depend on these instead of the public facades (`HarnessAgentSessionService`, `HarnessAgentSessionManager`, etc.), making future refactors harder.

Affected files

• `packages/server/src/harness/index.ts`
• RPC imports: `packages/server/src/rpc/runtime.ts`, `context.ts`, `session.ts`

Suggested fix

Narrow `harness/index.ts` to the five public roles plus shared event types. Keep internals imported via relative paths inside `harness//` and tests.

Related

• arch: stop exporting makeEventBus from public @vibest/server/events #272 (stop exporting `makeEventBus` publicly — same class of boundary leak)

Severity

P3