ensure security.harness uses harness.default if empty or not set in .thirdshift/config.toml #598

Also clarify "# the Harness a Security run uses unless its command names one; default blank, for harness.default or Claude Code" - the "for harness.default or Claude Code" phrase confuses me a bit

example config.toml:
[harness]
default = "codex" # the Harness every Run's sessions run on, claude or codex; default claude

[harness.claude]
model = "claude-opus-5-5" # the Model Claude Code's sessions run on; default blank, for Claude Code's own
effort = "medium" # how hard that Model reasons; default blank, for Claude Code's own

[harness.codex]
model = "gpt-6.1-sol" # the Model Codex's sessions run on; default blank, for Codex's own
effort = "high" # how hard that Model reasons; default blank, for Codex's own

[security]
fix = true # Security runs may fix reproduced findings; default false
review = true # Runs review their change for Security findings; default false
harness = "" # the Harness a Security run uses unless its command names one; default blank, for harness.default or Claude Code