Add Phase 0a black-box integration test suite

81 tests across 11 files plus a 5-module harness (load, pg, streams,
containers, payloads), covering all eleven Phase 0 goals and all 13 named
chaos-flag pathologies. Talks to the system only over HTTP, Postgres, Redis,
and the Docker CLI -- no imports of application code. RED-BASELINE.md records
the suite failing red against the empty repo before any implementation
existed; README.md documents the request-contract fields invented to fill
gaps in the spec, measurement methodology, and known-flaky tests.

This suite is a frozen contract from this point forward per CLAUDE.md.

tests/harness/config.py

@@ -0,0 +1,43 @@
+"""Environment-driven configuration shared by tests and harness helpers.
+
+Every value here can be overridden via env var; the defaults match the ports
+documented in the project READMEs (gateway 8000, ledger..notifier 8001-8005,
+postgres 5432, redis 6379). No test file should hardcode a port or DSN --
+import it from here instead.
+"""
+import os
+from pathlib import Path
+
+# tests/harness/config.py -> parents[0]=harness, [1]=tests, [2]=repo root
+REPO_ROOT = Path(__file__).resolve().parents[2]
+
+GATEWAY_URL = os.environ.get("GATEWAY_URL", "http://localhost:8000")
+SERVICE_URLS = {
+    "gateway": GATEWAY_URL,
+    "ledger": os.environ.get("LEDGER_URL", "http://localhost:8001"),
+    "fraud": os.environ.get("FRAUD_URL", "http://localhost:8002"),
+    "sanctions": os.environ.get("SANCTIONS_URL", "http://localhost:8003"),
+    "insights": os.environ.get("INSIGHTS_URL", "http://localhost:8004"),
+    "notifier": os.environ.get("NOTIFIER_URL", "http://localhost:8005"),
+}
+HTTP_SERVICES = tuple(SERVICE_URLS.keys())
+
+POSTGRES_DSN = os.environ.get(
+    "POSTGRES_DSN", "postgresql://ledgerline:ledgerline@localhost:5432/ledgerline"
+)
+REDIS_URL = os.environ.get("REDIS_URL", "redis://localhost:6379/0")
+
+STREAM_NAME = os.environ.get("LEDGERLINE_STREAM", "stream:transactions")
+CONSUMER_GROUPS = ("notifier", "audit")
+
+DEFAULT_HTTP_TIMEOUT = float(os.environ.get("LEDGERLINE_HTTP_TIMEOUT", "15.0"))
+
+SEED = int(os.environ.get("SEED", "42"))
+
+# Assumption documented in tests/README.md under "Log-line assumptions": the
+# sanctions service logs a line containing "lookup" for every watchlist check
+# it performs, and every service logs a line containing "healthz" when its
+# health endpoint is hit. Agent B's implementation must satisfy these for the
+# 6.8/6.9/6.14 pathology tests to be meaningful.
+SANCTIONS_LOOKUP_LOG_PATTERN = r"(?i)lookup"
+HEALTHZ_LOG_PATTERN = r"(?i)healthz"