init: seed framework reference content from agent-runtimes main repo

harnesses/contexts/gitea-ssh/v1/harness.yaml

@@ -0,0 +1,24 @@
+kind: context
+name: gitea-ssh
+version: 1
+description: "Gitea SSH: clone/push via SSH key for gitea.oreillyit.nz (ai_enablement)"
+requires: []
+provides: [git-access]
+
+git_identity:
+  name: "agent-runtimes"
+  email: "agent@oreillyit.nz"
+
+ssh_hosts:
+  - alias: gitea.oreillyit.nz-ai-enablement
+    hostname: gitea.oreillyit.nz
+    user: git
+    identity_secret: GITEA_SSH_KEY
+
+scripts:
+  init: "./init.sh"
+
+secrets_files:
+  - source: ./ssh-key.sops.env
+    target: /opt/harness/secrets/gitea-ssh/ssh-key.sops.env
+    encrypted: true

harnesses/contexts/gitea-ssh/v1/init.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+set -euo pipefail
+
+# Extract SSH private key from decrypted env file and write to the per-host
+# identity file path. The meta-init script generates ~/.ssh/config with
+# IdentityFile /home/agent/.ssh/gitea-oreillyit-nz-ai-enablement
+# matching the ssh_hosts alias in harness.yaml.
+
+SSH_KEY_FILE="/home/agent/.ssh/gitea-oreillyit-nz-ai-enablement"
+
+# Find the decrypted env file (dispatcher decrypts SOPS at dispatch time for K8s,
+# or the meta-init script decrypts for Docker)
+for env_file in /opt/harness/secrets/gitea-ssh/*.decrypted.env /opt/harness/secrets/gitea-ssh/*.env; do
+    [ -f "$env_file" ] || continue
+    while IFS='=' read -r key value; do
+        # Skip comments and blank lines
+        [[ "$key" =~ ^[[:space:]]*# ]] && continue
+        [[ -z "$key" ]] && continue
+        if [ "$key" = "GITEA_SSH_KEY" ]; then
+            mkdir -p /home/agent/.ssh
+            echo "$value" | base64 -d > "$SSH_KEY_FILE"
+            chmod 600 "$SSH_KEY_FILE"
+            chown agent:agent "$SSH_KEY_FILE"
+            echo "SSH key written to $SSH_KEY_FILE"
+            break 2
+        fi
+    done < "$env_file"
+done
+
+if [ ! -f "$SSH_KEY_FILE" ]; then
+    echo "WARNING: GITEA_SSH_KEY not found in any env file under /opt/harness/secrets/gitea-ssh/"
+fi