feat(harness): workflow-script-nocp/v1 + workflow-script-write/v1 composites (Option C, WF-COMP-31b/31c, item 26754227)

nocp: shared-variables/v1 + repo-readonly/v1 (no CP credential).
write: shared-variables/v1 + cp-write-token/v1 + repo-readonly/v1.
repo-readonly/v1 is last in both (WF-COMP-34); neither layers
cp-service-token/v1 or gitea-ssh/v1.

HOLD: do not merge until the CP release (AU-55/55a/56/57, WF-COMP-31b engine/
dispatch/compiler composite-set changes) and the dispatcher image
(cp-write-token delivery, AU-55b) are deployed. The dispatcher advertises every
composite found in the CRS-synced harnesses/ tree (dispatcher/poller.py
_collect_supported_harnesses), so merging this to origin/main IS the
advertisement event.

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

tests/invariants/test_workflow_script_option_c_composites.py

@@ -0,0 +1,94 @@
+"""workflow-script-nocp/v1 and workflow-script-write/v1 (Option C, WF-COMP-31b/31c).
+
+Layer order is load-bearing: shared-variables first, repo-readonly LAST
+(WF-COMP-34), and neither composite may carry the AU-51 internal bearer
+(cp-service-token/v1) or the write-capable gitea-ssh/v1. Only the write
+composite carries the AU-55 per-step token layer.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+import yaml
+
+from tests.invariants.forge_credentials import _layer_has_forge_credentials
+
+_ROOT = Path(__file__).resolve().parents[2] / "harnesses"
+_KIND_TO_DIR = {"context": "contexts", "capability": "capabilities", "composite": "composites"}
+
+_NOCP = [{"context": "shared-variables/v1"}, {"context": "repo-readonly/v1"}]
+_WRITE = [
+    {"context": "shared-variables/v1"},
+    {"context": "cp-write-token/v1"},
+    {"context": "repo-readonly/v1"},
+]
+
+
+def _load(kind_dir: str, name: str) -> dict:
+    return yaml.safe_load((_ROOT / kind_dir / name / "v1" / "harness.yaml").read_text())
+
+
+def _merged_env(doc: dict) -> dict:
+    env: dict = dict(doc.get("env") or {})
+    for layer in doc["layers"]:
+        (kind, ref), = layer.items()
+        env.update(_load(_KIND_TO_DIR[kind], ref.split("/")[0]).get("env") or {})
+    return env
+
+
+@pytest.mark.parametrize(
+    "name,expected", [("workflow-script-nocp", _NOCP), ("workflow-script-write", _WRITE)]
+)
+def test_composite_layers_exact_order_repo_readonly_last(name, expected):
+    doc = _load("composites", name)
+    assert doc["kind"] == "composite"
+    assert doc["name"] == name
+    assert doc["version"] == 1
+    assert doc["layers"] == expected
+    assert doc["layers"][-1] == {"context": "repo-readonly/v1"}
+
+
+@pytest.mark.parametrize("name", ["workflow-script-nocp", "workflow-script-write"])
+def test_composite_never_carries_internal_bearer_or_write_capable_forge_key(name):
+    doc = _load("composites", name)
+    names = [next(iter(layer.values())).split("/")[0] for layer in doc["layers"]]
+    assert "cp-service-token" not in names
+    assert "gitea-ssh" not in names
+    for layer in doc["layers"]:
+        (kind, ref), = layer.items()
+        sub = _load(_KIND_TO_DIR[kind], ref.split("/")[0])
+        if _layer_has_forge_credentials(sub):
+            assert sub.get("write_targets") == [], f"{ref} must be read-only (HC-11)"
+
+
+@pytest.mark.parametrize("name", ["workflow-script-nocp", "workflow-script-write"])
+def test_every_referenced_layer_exists_and_names_match(name):
+    doc = _load("composites", name)
+    for layer in doc["layers"]:
+        (kind, ref), = layer.items()
+        lname, ver = ref.split("/")
+        path = _ROOT / _KIND_TO_DIR[kind] / lname / ver / "harness.yaml"
+        assert path.exists(), path
+        assert yaml.safe_load(path.read_text())["name"] == lname
+
+
+def test_nocp_composite_exports_no_cp_credential_env():
+    env = _merged_env(_load("composites", "workflow-script-nocp"))
+    assert "CP_SERVICE_TOKEN_FILE" not in env
+    assert "CP_WRITE_TOKEN_FILE" not in env
+    assert env["WORKFLOW_VARIABLES_ROOT"] == "/variables"
+
+
+def test_write_composite_env_contract():
+    env = _merged_env(_load("composites", "workflow-script-write"))
+    assert env["CP_WRITE_TOKEN_FILE"] == "/run/agent/cp-write-token/token"
+    assert "CP_SERVICE_TOKEN_FILE" not in env
+    assert env["WORKFLOW_VARIABLES_ROOT"] == "/variables"
+
+
+def test_workflow_script_write_composite_layers_and_env_contract():
+    """Spec WF-COMP-31c test handle (framework repo)."""
+    doc = _load("composites", "workflow-script-write")
+    assert doc["layers"] == _WRITE
+    assert _merged_env(doc)["CP_WRITE_TOKEN_FILE"] == "/run/agent/cp-write-token/token"