fix(bug-verify-sonnet@1): agent self-transitions flow_state, remove dead verdict-tx node

verdict-tx (kind: script) never worked: script nodes are harness-exempt
(WF-COMP-6/MN-38) and run in their own empty container, so it could
never credentially read /workspace/verdict from the agent's node.

Option 3: give the agent node's own composite (planning-sonnet-repo) a
cp-service-token/v1 layer, and have the agent PATCH its own item's
flow_state (verified|rejected) to the CP directly as its last step,
before task_complete. Removes verdict-tx entirely.

See agent-runtimes work item 88ecd23e and spec/typed-workflows.md
WF-COMP-25 (agent-runtimes commit 8972d266) for the finalize.py
precedence fix this depends on (ambiguous pipe-separated output.state
must never be auto-PATCHed over the agent's own value).

Claude-Session: https://claude.ai/code/session_01U3biMxRhFGkwtf4jVTNjcj

harnesses/composites/planning-sonnet-repo/v1/harness.yaml

@@ -8,3 +8,8 @@ layers:
   - context: anthropic-cloud-paul-oauth/v1
   - context: gitea-ssh/v1
   - context: agent-repo/v1
+  # AU-51/AU-51b: this composite backs bug-verify-sonnet@1, whose agent node
+  # self-transitions its own item's flow_state (PATCH /v1/work-items/{id})
+  # as its final step — see work item 88ecd23e ("agent self-transition"
+  # pattern, spec/typed-workflows.md). Needs a CP write credential.
+  - context: cp-service-token/v1