feat(harness): cp-write-token/v1 context layer (Option C, WF-COMP-31c, item 26754227)

Env-only layer exporting CP_WRITE_TOKEN_FILE=/run/agent/cp-write-token/token.
The per-step wfcw_ token is delivered by the dispatcher into the script
container only (AU-55b), so the layer has no secrets_required, init script or
files. Not referenced by any composite yet; safe to merge at any time.

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

tests/invariants/test_cp_write_token_layer.py

@@ -0,0 +1,37 @@
+"""cp-write-token/v1 context: env-only layer (WF-COMP-31c, AU-55b).
+
+The per-step wfcw_ token is delivered by the dispatcher into the script
+container only (Secret projection on K8s, create -> put_archive -> start on
+Docker). The layer must therefore set the env contract and nothing else: no
+ESO secret mount, no init script, no context files.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import yaml
+
+_ROOT = Path(__file__).resolve().parents[2] / "harnesses"
+
+
+def _load(kind_dir: str, name: str) -> dict:
+    return yaml.safe_load((_ROOT / kind_dir / name / "v1" / "harness.yaml").read_text())
+
+
+def test_cp_write_token_layer_sets_env_contract():
+    doc = _load("contexts", "cp-write-token")
+    assert doc["kind"] == "context"
+    assert doc["name"] == "cp-write-token"
+    assert doc["version"] == 1
+    assert doc["env"] == {"CP_WRITE_TOKEN_FILE": "/run/agent/cp-write-token/token"}
+
+
+def test_cp_write_token_layer_is_env_only():
+    doc = _load("contexts", "cp-write-token")
+    assert not doc.get("secrets_required"), "token is not an ESO mount (AU-55b)"
+    assert not doc.get("scripts"), "no init script: the backend delivers the file"
+    assert not doc.get("context_files")
+    assert not doc.get("write_targets")
+    assert doc.get("requires") == []
+    assert doc.get("provides") == []
+    assert not (_ROOT / "contexts" / "cp-write-token" / "v1" / "init.sh").exists()