Closes #141

Summary

• make real install writes fail closed by default when required Runtime Bindings are missing or blank
• keep dry-run previews non-mutating while still using strict Package Template Reference syntax checks
• hide legacy --strict-bindings and public --allow-unresolved-bindings help entries while retaining compatibility parsing
• append hyard vars init ... --out .harness/vars.yaml and retry guidance to binding/template-reference install failures

Dev Brief Mapping

• Public install writes no longer produce unresolved placeholders as normal output.
• Missing bindings and strict template render failures occur before package-owned runtime output or install records are written.
• Help no longer teaches strictness as an advanced mode or unresolved bindings as normal behavior.

Validation

• go test ./cmd/harness/cli -count=1
• go test ./cmd/harness/cli/commands -count=1
• go test ./cmd/hyard/cli -run 'Test.*Install|Test.*Help|TestHyardRoot' -count=1
• go test ./cmd/harness/cli ./cmd/harness/cli/commands ./cmd/hyard/cli ./cmd/orbit/cli/harness ./cmd/orbit/cli/template -count=1
• mise run fix
• mise run ci