fix: telemetry/memory flag mismatches, doc drift; add CI; self-dogfood

Parallel fleet audit (2 background agents) + direct work:

- src/commands/memory.mjs: `memory put --allow-secrets` was read as
  `flags.allowSecrets` (camelCase) but the CLI parser only emits
  kebab-case keys, so the flag was always undefined/false. Fixed to
  `flags['allow-secrets']`.
- Docs: `lh graph --brief` was referenced 14x across 5 agent.md files,
  harness.instructions.md, 4 SKILL.md files, onboard.prompt.md, and
  README, but `lh graph` has no --brief flag (terse output is already
  the default, --json/--severity are the only flags). Corrected every
  reference to match actual CLI surface.
- .github/workflows/ci.yml: run npm install/validate/test on node 20+22.
- Self-dogfooded `lh init --yes` in this repo, producing .agents/
  (harness.config.json, architecture.md, conventions.md, memory
  shards). `lh doctor` now reports all required checks green.
- Deduped .gitignore harness block against init's auto-managed block.

Verified: 53/53 tests pass, validate 0 errors, doctor all-green.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.agents/conventions.md

@@ -0,0 +1,38 @@
+# agents-2026 conventions
+
+<!-- Living document. Promote repeated review feedback and user corrections here. Keep rules specific, checkable, and current. -->
+
+## Code style
+
+- Prefer simple control flow and explicit names.
+- Keep side effects at boundaries.
+
+## Naming
+
+- Use domain terms consistently.
+- Name files after their primary responsibility.
+
+## Testing
+
+- Cover changed behaviour with the smallest meaningful test.
+- Add regression tests for fixed bugs.
+
+## Error handling
+
+- Fail fast on invalid inputs.
+- Preserve actionable error context without leaking secrets.
+
+## Commit format
+
+- Use concise conventional commits when possible.
+- Explain why in the body when not obvious.
+
+## Directory layout
+
+- Keep generated artifacts out of source directories.
+- Put shared deterministic helpers in library modules.
+
+## Review rules
+
+- Verify scoped files only.
+- Flag correctness, security, and contract drift before style.