feat(harnessx): configurable provider + per-task budget caps

Add a [harnessx] config block so the agentic plane can be steered from
openultrasast.toml, and make the LLM provider selectable (the hunter and verifier
previously hardcoded AnthropicProvider).

- config.HarnessxConfig: provider ("anthropic"|"openai"|"litellm", default
  anthropic), max_cost_usd (2.0), token_threshold (120000); parsed from [harnessx].
- harness_ext.build_provider: single lazy, capability-guarded provider factory.
  The provider name is validated before any import, so an unknown choice fails with
  a clear ValueError even when the extra is absent; each provider reads its own
  standard key env var (openai -> OPENAI_API_KEY, anthropic -> ANTHROPIC_API_KEY).
- HxScanOrchestrator and verify_findings_dispatch take a provider and route through
  build_provider; cli threads config.harnessx.{provider,max_cost_usd,token_threshold}
  into both the hunter and the verifier.
- README: "Configuring the HarnessX agentic plane" section (install, models,
  provider, budgets, fallback/degradation).

Test isolation: convert the "harnessx not in sys.modules" import-guards to a
hermetic subprocess fixture (tests/conftest.py assert_cold_of_harnessx) and
simulate extra-absent in the CLI dispatch tests, so the suite is deterministic
whether or not the optional extra is installed (it now is, locally). Verified the
OpenAI path constructs end-to-end (build_provider -> OpenAIProvider; orchestrator
-> Harness) with the budget threaded through.

137 passed, 3 skipped; ruff + mypy clean; detection gate PASS.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

src/openultrasast/hunter_harness.py

@@ -18,7 +18,7 @@ from pathlib import Path
 from typing import Any
 
 from .findings import SEVERITY_LABEL, StaticFinding, _reachability_conditions, _reachability_for_line
-from .harness_ext import build_sast, require_harnessx
+from .harness_ext import build_provider, build_sast, require_harnessx
 from .hunter import (
     HunterPoolResult,
     HunterTask,
@@ -49,19 +49,26 @@ class ScanTask:
 class HxScanOrchestrator:
     """Runs the hunter pool on a real HarnessX agent loop, one bounded task per target."""
 
-    def __init__(self, *, provider_model: str, max_cost_usd: float = 2.0, token_threshold: int = 120_000) -> None:
+    def __init__(
+        self,
+        *,
+        provider_model: str,
+        provider: str = "anthropic",
+        max_cost_usd: float = 2.0,
+        token_threshold: int = 120_000,
+    ) -> None:
         require_harnessx()
         self._provider_model = provider_model
+        self._provider = provider
         self._max_cost_usd = max_cost_usd
         self._token_threshold = token_threshold
         self._agent: Any = None
 
     def _build_agent(self) -> Any:
         from harnessx.core.model_config import ModelConfig
-        from harnessx.providers.anthropic_provider import AnthropicProvider
 
         config = build_sast(max_cost_usd=self._max_cost_usd, token_threshold=self._token_threshold)
-        return ModelConfig(main=AnthropicProvider(model=self._provider_model)).agentic(config)
+        return ModelConfig(main=build_provider(self._provider_model, self._provider)).agentic(config)
 
     def run_pool(
         self,