Build the separate integration harness for the paths that need real hardware or a real server

[iderex]

Some paths cannot be proven against a fake. Image decoding at real sizes on real
hardware, a genuine TLS handshake against a genuine certificate chain, a real
server's behaviour under a real sign-in. Pretending those are covered by the
headless suite is worse than admitting they are not.

So they get a separate harness with an honest name, run deliberately, and nothing
about it is allowed to make the headless suite in #20 conditional.

What the harness is

A separate target, not part of the default test command, named so that its name
says what it needs. It refuses to run rather than skipping silently when what it
needs is absent, and it prints what was missing.

Its results are never counted as part of the headless suite's coverage, and no
gate treats a skipped integration run as a pass.

Blocked on #20, which is where the headless suite this harness must not make
conditional is built. The label on this issue said so and the body did not, which
is the half a reader checks.

Done when

The harness exists as a separate target, running the default test command never
invokes it, invoking it without its prerequisites fails with a message naming
what was missing, and CONTRIBUTING.md says what it covers that the headless
suite cannot.

[iderex]

This issue names no blocker, and three of the four things its condition asks for
name artefacts that are not in this tree. Every tracked file outside .github/
and docs/ is a document, on f99497e:

git ls-tree -r --name-only origin/main | grep -Ev '^(\.github/|docs/)'
DCO
NOTICE.md
README.md

There is nothing a separate target could be declared in:

git ls-tree -r --name-only origin/main | grep -E 'go\.mod|Cargo\.toml|package\.json|pom\.xml|CMakeLists\.txt|Makefile|\.csproj$|\.sln$|pyproject\.toml' ; echo "exit=$?"
exit=1

and the file the fourth condition names is not there either:

git ls-tree -r --name-only origin/main | grep -x 'CONTRIBUTING.md' ; echo "exit=$?"
exit=1

So a separate target, a default test command that never invokes it, and a
refusal that names what was missing are statements about a build and a program.
Both come from #13, which waits on #11, which waits on entry 2 of #1. The
sentence about what the harness covers belongs to CONTRIBUTING.md, which is
#23, and describing a harness that does not exist yet is not the same condition.

I am recording this because the issue reads as ready. Every other issue in this
milestone that cannot start says what it waits on, and this one does not, so the
next person to reach for it finds that out after picking it up rather than
before.

Two things the harness has to carry are already settled elsewhere and will not
have to be found again. #20 places the bind to a machine's own interface address
here rather than in the headless suite, because the consent dialog that bind
raises is answered against the executable's full path and settles nothing for the
next build directory. #104 places the fixture comparison against a real server
here, and asks it to refuse rather than skip when no server is reachable, which
is the rule this issue already sets for everything in the harness.