test(02-01): hand-rolled harness + RED initdata vector suite (D-12, TDD RED)

- bot/test/harness.mjs: zero-dep registry (test(name, fn))
- bot/test/runner.mjs: auto-discovers *.test.mjs, suite-load failure -> FAIL case, exit 0 iff all green
- bot/test/initdata.test.mjs: T1-T7 vector contract signed via node:crypto in-suite
  (T1 known-good, T2 tampered, T3 stale 3600s, T4 boundary 899/901, T5 order-independence,
  T6a-c malformed, T7 RFC-4231 node:crypto independence pin)
- demonstrated RED: 8 FAILs / exit 1 against missing src/security/initdata.ts; GREEN lands in plan 02

bot/test/harness.mjs

@@ -0,0 +1,10 @@
+/*
+ * harness.mjs — zero-dependency test registry (D-12).
+ * Suites import { test } and register async cases; runner.mjs drains the registry.
+ * Same hand-rolled shape as theme/scripts/audit.test.mjs (Phase 1 precedent).
+ */
+const tests = [];
+export function test(name, fn) {
+  tests.push({ name, fn });
+}
+export const registry = tests;