feat(harness): cp-service-token/v1 context — AU-51/AU-51b credential for decompose

New context mounts the cp-decompose-service-token account (system
provider type, account_id 1d963673-6ac9-4f85-875a-2ce5323e76ad, owner
(cp, cp)) via ESO and exports CP_SERVICE_TOKEN_FILE pointing at the
mounted secret file. Wired into spec-writing-sonnet-repo (backs
scope-decompose-sonnet@1, which calls back POST
/v1/work-items/{id}/decompose — bug b3a96acc / fa41caac / M42 stall).

The mounted value must match the CP's CP_INTERNAL_BEARER_TOKEN
(agent-runtimes deploy repo, overlays/{production,staging}/app-secret.sops.yaml).

No init.sh needed — the mount path is static at harness-authoring time
and entrypoint/actions/decompose_work_items.py (AU-51b, agent-runtimes
commit 0fa8b760) reads CP_SERVICE_TOKEN_FILE directly, so no
transformation/staging step is required.

harnesses/composites/spec-writing-sonnet-repo/v1/harness.yaml

@@ -8,3 +8,6 @@ layers:
   - context: anthropic-cloud-paul-oauth/v1
   - context: gitea-ssh/v1
   - context: agent-repo/v1
+  # AU-51/AU-51b: this composite backs scope-decompose-sonnet@1, which
+  # calls back POST /v1/work-items/{id}/decompose — needs a credential.
+  - context: cp-service-token/v1