test: add resumable isolated test harness

docs/README.md

@@ -15,6 +15,8 @@ Read the documents in this order:
    resolution, cross-field validation, and annotated server/client examples.
 6. [Go implementation plan](implementation-plan.v1.md) — phased build order,
    package boundaries, storage/session/client details, tests, and release gates.
+7. [Implementation testing](testing.md) — container entry points, run
+   lifecycle, exact cleanup, and coverage inventory.
 
 The wire authority is in [`../protos/rvbox/v1`](../protos/rvbox/v1):
 `common.proto` contains shared data types, `agent.proto` contains the

docs/testing.md

@@ -0,0 +1,46 @@
+# RVBox implementation test workflow
+
+All Go, protobuf, and harness work runs in the pinned toolchain container. No
+host Go installation is used.
+
+Run the normal pre-commit gate with:
+
+```sh
+make verify
+```
+
+Run focused unit tests with:
+
+```sh
+scripts/test-unit --package ./internal/domain --run UUIDv7 --race
+```
+
+The integration harness currently provides the Phase 0 `sample` suite. It
+proves run isolation and the durable lifecycle without starting an RVBox
+service that has not been implemented yet:
+
+```sh
+scripts/test-env doctor
+scripts/test-integration --suite sample --run-id my-sample
+scripts/test-env status --run-id my-sample
+scripts/test-env collect --run-id my-sample
+scripts/test-env reset --run-id my-sample
+scripts/test-env reuse --run-id my-sample
+scripts/test-integration --suite sample --run-id my-sample --resume
+scripts/test-env reset --run-id my-sample
+scripts/test-env purge --run-id my-sample
+```
+
+Each run owns only `.test-runs/<run-id>` and resources explicitly recorded in
+that run's versioned manifest. The journal is append-only and fsynced. `purge`
+validates the run ID and manifest identity, refuses symlink targets or manifests
+that still list runtime resources, and then removes only that exact run. Purged
+artifacts are not recoverable. Dependency cache volumes are never part of run
+cleanup.
+
+`test/coverage.toml` is the incremental requirement-to-test inventory. The
+`make verify` lint stage checks unique stable IDs and verifies every implemented
+test reference against source. Native Windows integration/E2E entries remain
+explicitly blocked until the resettable Windows host is available; Wine or a
+protocol stub is not treated as equivalent coverage.
+