feat(harness): workflow-script-nocp/v1 + workflow-script-write/v1 composites (Option C, WF-COMP-31b/31c, item 26754227)

nocp: shared-variables/v1 + repo-readonly/v1 (no CP credential).
write: shared-variables/v1 + cp-write-token/v1 + repo-readonly/v1.
repo-readonly/v1 is last in both (WF-COMP-34); neither layers
cp-service-token/v1 or gitea-ssh/v1.

HOLD: do not merge until the CP release (AU-55/55a/56/57, WF-COMP-31b engine/
dispatch/compiler composite-set changes) and the dispatcher image
(cp-write-token delivery, AU-55b) are deployed. The dispatcher advertises every
composite found in the CRS-synced harnesses/ tree (dispatcher/poller.py
_collect_supported_harnesses), so merging this to origin/main IS the
advertisement event.

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

harnesses/composites/workflow-script-nocp/v1/harness.yaml

@@ -0,0 +1,16 @@
+kind: composite
+name: workflow-script-nocp
+version: 1
+description: "Internal composite for kind: script nodes with cp_write=false (typed-workflows WF-COMP-31b, Option C). Brings the shared-variables filesystem context and the read-only project-repo clone, and NO CP credential: it layers neither cp-service-token/v1 (the AU-51 internal bearer) nor cp-write-token/v1 (the AU-55 per-step write token). Its only forge credential is repo-readonly/v1's read-only deploy key. Not model-bearing; the compiled shape is cli=\"shell\", params.cmd=<cmd>."
+
+# Top-down order (WF-COMP-31b / WF-COMP-34): shared-variables first, repo-readonly
+# LAST so its clone runs after the variable wiring and before the script starts.
+# Never gitea-ssh/v1 (bug 45a48685). repo-readonly/v1 cannot be dropped: the
+# entrypoint V2 guard trips when AGENT_REPO_URL is set and /workspace/project is
+# missing, and every shipped script template declares agent_repo.
+layers:
+  # spec/workflow-variables.md WV-19 / spec/harness.md HD-14 — agent-facing
+  # /variables/ context; provides the [shared-variables] tag.
+  - context: shared-variables/v1
+  # spec/typed-workflows.md WF-COMP-34 — read-only project-repo clone.
+  - context: repo-readonly/v1

harnesses/composites/workflow-script-write/v1/harness.yaml

@@ -0,0 +1,16 @@
+kind: composite
+name: workflow-script-write
+version: 1
+description: "Internal composite for kind: script nodes with cp_write=true (typed-workflows WF-COMP-31c, Option C). Brings the shared-variables filesystem context, the AU-55 per-step CP write token (cp-write-token/v1 sets CP_WRITE_TOKEN_FILE; the dispatcher delivers the wfcw_ file into the script container only, AU-55b) and the read-only project-repo clone. Omits cp-service-token/v1: a cp_write=true container gets the AU-55 token only, never the AU-51 internal bearer. Not model-bearing; the compiled shape is cli=\"shell\", params.cmd=<cmd>."
+
+# Top-down order (WF-COMP-31c / WF-COMP-34): shared-variables, cp-write-token,
+# repo-readonly LAST. Never gitea-ssh/v1 (bug 45a48685) and never
+# cp-service-token/v1.
+layers:
+  # spec/workflow-variables.md WV-19 / spec/harness.md HD-14.
+  - context: shared-variables/v1
+  # spec/authentication.md AU-55 / AU-55b — env-only layer; exports
+  # CP_WRITE_TOKEN_FILE=/run/agent/cp-write-token/token.
+  - context: cp-write-token/v1
+  # spec/typed-workflows.md WF-COMP-34 — read-only project-repo clone.
+  - context: repo-readonly/v1