feat: onboarding script, full lh flag reference, expanded README

- scripts/onboard.mjs: bootstraps a target repo onto the harness — copies
  the behaviour layer (.github/agents, skills, instructions, prompts,
  mcp.json, copilot-instructions.md, AGENTS.md), npm links the `lh` CLI,
  runs `lh init` + `lh doctor`, prints next steps. Idempotent: identical
  files are skipped, differing files require --force, re-running `lh init`
  on an initialized repo warns instead of failing. Supports --dry-run and
  --no-npm-link for CI/sandboxed use.
- tests/onboard.test.mjs: 5 new e2e tests (dry-run, full run, idempotent
  rerun, missing target dir, conflict + --force).
- README: new "Onboarding a new project" section, full lh flag reference
  for every subcommand (previously only one-line summaries), Development
  section mentions the onboarding script.

Live-tested against ~/Sources/ralph-runtime (a real, not-yet-git-tracked
project): git init, .github/ copied, `npm link` succeeded, `lh init`
ran, `lh doctor` correctly flagged its one real gap (no verify command
configured) rather than a false pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

README.md

@@ -103,6 +103,32 @@ To learn an unfamiliar codebase first:
 /onboard
 ```
 
+## Onboarding a new project
+
+Before the plugin is published to a marketplace (or if you want to try it against a local repo
+first), `scripts/onboard.mjs` does the whole bootstrap in one shot: copies the behaviour layer
+(`.github/agents`, `skills`, `instructions`, `prompts`, `mcp.json`, `copilot-instructions.md`,
+`AGENTS.md`) into a target repo, `npm link`s the `lh` CLI so it's on `PATH` there, runs
+`lh init` and `lh doctor`, and prints next steps.
+
+```bash
+# from inside this repo
+node scripts/onboard.mjs /path/to/target-repo --dry-run   # preview, writes nothing
+node scripts/onboard.mjs /path/to/target-repo --yes        # do it
+```
+
+| Flag | Effect |
+| --- | --- |
+| `--yes` | Non-interactive: auto `git init` if needed, run `lh init` without asking |
+| `--force` | Overwrite target files that already exist and differ (default: skip + warn) |
+| `--dry-run` | Print the plan, write and run nothing |
+| `--no-npm-link` | Skip `npm link`; print the absolute `node .../src/cli.mjs` invocation instead |
+
+Safe to re-run: files that are already identical are left alone, and re-running `lh init` on an
+already-initialized repo warns instead of failing (rerun with `lh init --force` to reset).
+`npm install -g @redsen/lean-harness` (once published) replaces steps 3–5 of the script with a
+normal global install.
+
 ## Pipeline
 
 ```
@@ -163,6 +189,43 @@ exploration is deliberately pushed onto the cheap tier; only summaries return to
 | `lh report [runId] [--journal]` | Markdown telemetry report / run journal |
 | `lh doctor` | Environment checks |
 
+### Full flag reference
+
+<details>
+<summary>Every flag each subcommand reads (click to expand)</summary>
+
+- `lh init [--yes] [--force] [--json]` — `--yes` skips prompts with defaults; `--force` re-initializes
+  an existing `.agents/harness.config.json`.
+- `lh index [--budget N] [--focus <glob>] [--fetch] [--force] [--stats] [--json]` — `--fetch` lazily
+  downloads/caches missing tree-sitter grammars; `--force` rebuilds the cache instead of reusing it;
+  `--stats` prints token counts instead of the map.
+- `lh graph [--severity <level>] [--fix-manifest] [--json]` — terse brief is the default output;
+  `--fix-manifest` rewrites `codegraph.manifest.json`-style baselines.
+- `lh lane create --id <id> [--title t] [--kind read\|write] [--scope glob...] [--depends-on id]
+  [--base ref] [--json]`
+- `lh lane list [--status s] [--run-id id] [--json]`
+- `lh lane status --id <id> [--json]`
+- `lh lane merge --id <id> [--abort] [--strategy s] [--json]`
+- `lh lane drop --id <id> [--force] [--json]`
+- `lh run start --objective "..." [--spec slug] [--host h] [--strategy s] [--attrs '{"k":"v"}']
+  [--json]`
+- `lh run event --run <id> --type <t> [--name n] [--status ok\|fail] [--agent a] [--lane id]
+  [--model m] [--operation op] [--input-tokens N] [--output-tokens N] [--duration-ms N]
+  [--exit-code N] [--attrs '{"k":"v"}'] [--json]`
+- `lh run end --run <id> [--status ok\|fail] [--summary "..."] [--json]`
+- `lh run list [--json]` / `lh run show [runId] [--json]`
+- `lh memory list [--shard s] [--json]`
+- `lh memory get --shard s [--query q] [--limit N] [--json]`
+- `lh memory put --shard s --title t [--body "..." | piped via stdin] [--tags a,b] [--allow-secrets]
+  [--json]` — writes are refused if a secret pattern matches unless `--allow-secrets` is set.
+- `lh memory compact [--force] [--json]`
+- `lh memory scan` — secret scan only, no write
+- `lh host [--strategy s] [--json]`
+- `lh report [runId] [--run-id id] [--json] [--board] [--journal] [--spec slug] [--write]`
+- `lh doctor [--json]`
+
+</details>
+
 ## Repository footprint
 
 The harness writes into one configurable directory:
@@ -222,11 +285,13 @@ npm install
 npm run validate     # manifests + every markdown frontmatter block
 npm test
 node src/cli.mjs --help
+node scripts/onboard.mjs <target-dir> --dry-run   # preview bootstrapping another repo
 ```
 
 `npm run validate` is the distribution gate: it checks `plugin.json`, `marketplace.json`,
 agent/skill/instruction frontmatter, delegation targets, and scans `.github/mcp.json` for
-committed secrets.
+committed secrets. `npm test` covers config, memory, lane scope safety, glob matching, secret
+scanning, telemetry, and the onboarding script end to end (`tests/onboard.test.mjs`).
 
 ## Prior art