init: seed framework reference content from agent-runtimes main repo

harnesses/contexts/gitea-https/v1/harness.yaml

@@ -0,0 +1,18 @@
+kind: context
+name: gitea-https
+version: 1
+description: "Gitea HTTPS: git credential helper + identity for token-based cloning and pushing"
+requires: []
+provides: [git-access]
+
+git_identity:
+  name: "agent-runtimes"
+  email: "agent@oreillyit.nz"
+
+scripts:
+  init: "./init.sh"
+
+secrets_files:
+  - source: ./provider.sops.env
+    target: /opt/harness/secrets/gitea-https/provider.sops.env
+    encrypted: true

harnesses/contexts/gitea-https/v1/init.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# Configure git to use GITEA_TOKEN for HTTPS cloning/pushing to gitea.oreillyit.nz
+#
+# Uses a credential helper script that reads the token from the environment.
+# This avoids embedding the token in clone URLs (which would appear in logs).
+
+set -euo pipefail
+
+CRED_HELPER="/opt/harness/contexts/gitea-https/v1/git-credential-gitea.sh"
+
+# Create the credential helper script
+cat > "$CRED_HELPER" << 'HELPER_EOF'
+#!/bin/bash
+# Git credential helper that provides GITEA_TOKEN for gitea.oreillyit.nz
+if [ -z "${GITEA_TOKEN:-}" ]; then
+    exit 1
+fi
+echo "protocol=https"
+echo "host=gitea.oreillyit.nz"
+echo "username=token"
+echo "password=${GITEA_TOKEN}"
+HELPER_EOF
+
+chmod +x "$CRED_HELPER"
+
+# Configure git to use this credential helper for gitea.oreillyit.nz
+git config --global credential.https://gitea.oreillyit.nz.helper "$CRED_HELPER"
+
+echo "Git HTTPS credential helper configured for gitea.oreillyit.nz"