test(02-01): hand-rolled harness + RED initdata vector suite (D-12, TDD RED)

- bot/test/harness.mjs: zero-dep registry (test(name, fn))
- bot/test/runner.mjs: auto-discovers *.test.mjs, suite-load failure -> FAIL case, exit 0 iff all green
- bot/test/initdata.test.mjs: T1-T7 vector contract signed via node:crypto in-suite
  (T1 known-good, T2 tampered, T3 stale 3600s, T4 boundary 899/901, T5 order-independence,
  T6a-c malformed, T7 RFC-4231 node:crypto independence pin)
- demonstrated RED: 8 FAILs / exit 1 against missing src/security/initdata.ts; GREEN lands in plan 02

bot/test/runner.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+/*
+ * runner.mjs — hand-rolled zero-dependency test runner (D-12).
+ *
+ * - Auto-discovers *.test.mjs in this directory (sorted) and dynamic-imports them.
+ * - A suite that fails to LOAD is recorded as one failing case
+ *   ("suite load failed: <file>") — the run never crashes mid-way.
+ * - Per case: PASS <name> / FAIL <name> (+ error detail).
+ * - Summary line + exit codes: exit 0 only when every case passed.
+ */
+import { readdirSync } from "node:fs";
+import { registry } from "./harness.mjs";
+
+const dir = import.meta.dirname;
+const suites = readdirSync(dir)
+  .filter((f) => f.endsWith(".test.mjs"))
+  .sort();
+
+for (const file of suites) {
+  try {
+    await import(`./${file}`);
+  } catch (loadErr) {
+    registry.push({
+      name: `suite load failed: ${file}`,
+      fn: () => {
+        throw loadErr;
+      },
+    });
+  }
+}
+
+let passedCount = 0;
+let failedCount = 0;
+for (const { name, fn } of registry) {
+  try {
+    await fn();
+    passedCount++;
+    console.log(`PASS ${name}`);
+  } catch (err) {
+    failedCount++;
+    console.log(`FAIL ${name}`);
+    console.error(`  ${err && err.stack ? err.stack : String(err)}`);
+  }
+}
+
+console.log(`[runner] ${passedCount} passed, ${failedCount} failed`);
+process.exitCode = failedCount > 0 ? 1 : 0;