chore(z-ai): retire harness — no active subscription

Removes harnesses/contexts/z-ai/v1/. Mirrors the agent-runtimes
companion PR — the z-ai harness was never cut over to ESO and
there's no active subscription. Revival path documented in
agent-runtimes planning/future/providers F49.

Removed:
- harnesses/contexts/z-ai/v1/{harness.yaml, init.sh}

Updated:
- CLAUDE.md — drops z-ai from the 'no secrets in this repo'
  context list. Retirement note added.
- gitea-admin/v1/init.sh — comment ref to z-ai removed.
- gitea-https/v1/init.sh — comment ref to z-ai removed.

No composites layer z-ai (verified via grep across composites/);
no model registry entries reference it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

harnesses/contexts/z-ai/v1/harness.yaml

@@ -1,28 +0,0 @@
-kind: context
-name: z-ai
-version: 1
-description: "Z.ai GLM coding plan — Anthropic-compatible proxy"
-requires: []
-provides: [claude-code]
-
-env:
-  ANTHROPIC_BASE_URL: "https://api.z.ai/api/anthropic"
-  CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS: "1"
-  CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
-  DISABLE_PROMPT_CACHING: "1"
-
-secrets_required:
-  - name: z-ai
-    account_ref: "z-ai"
-    mount_path: /run/agent/secrets/z-ai
-    # 0400 (root-only) — defense in depth. The agent user cannot read this
-    # mount. init.sh runs as root and stages the auth_token into the agent's
-    # home with mode 0600. apiKeyHelper points at the staged copy. Matches
-    # the gitea-ssh pattern; if the ESO Secret later carries additional
-    # files (e.g. base_url is already there), they remain inaccessible.
-    mode: "0400"
-
-scripts:
-  init: "./init.sh"
-
-# TODO: Add network_hosts for api.z.ai when context harnesses support it