feat(harness): cp-service-token/v1 context — AU-51/AU-51b credential for decompose

New context mounts the cp-decompose-service-token account (system
provider type, account_id 1d963673-6ac9-4f85-875a-2ce5323e76ad, owner
(cp, cp)) via ESO and exports CP_SERVICE_TOKEN_FILE pointing at the
mounted secret file. Wired into spec-writing-sonnet-repo (backs
scope-decompose-sonnet@1, which calls back POST
/v1/work-items/{id}/decompose — bug b3a96acc / fa41caac / M42 stall).

The mounted value must match the CP's CP_INTERNAL_BEARER_TOKEN
(agent-runtimes deploy repo, overlays/{production,staging}/app-secret.sops.yaml).

No init.sh needed — the mount path is static at harness-authoring time
and entrypoint/actions/decompose_work_items.py (AU-51b, agent-runtimes
commit 0fa8b760) reads CP_SERVICE_TOKEN_FILE directly, so no
transformation/staging step is required.

harnesses/contexts/cp-service-token/v1/harness.yaml

@@ -0,0 +1,23 @@
+kind: context
+name: cp-service-token
+version: 1
+description: "CP-internal service bearer token — authenticates agent-container write calls back to the control plane (AU-51/AU-51b, bug b3a96acc)"
+requires: []
+provides: []
+
+# AU-51b: static env pointing at the ESO-mounted secret file. No init.sh
+# needed — the mount path is fixed at harness-authoring time (unlike
+# anthropic-cloud-paul-oauth/v1, which transforms its secret into a
+# different file format and therefore needs a staging script), and
+# decompose_work_items_action reads CP_SERVICE_TOKEN_FILE directly.
+# The value at this path MUST match the CP's CP_INTERNAL_BEARER_TOKEN
+# (same account: cp-decompose-service-token, account_id
+# 1d963673-6ac9-4f85-875a-2ce5323e76ad, owner (cp, cp)).
+env:
+  CP_SERVICE_TOKEN_FILE: /run/agent/secrets/cp-service-token/value
+
+secrets_required:
+  - name: cp-service-token
+    account_ref: "1d963673-6ac9-4f85-875a-2ce5323e76ad"
+    mount_path: /run/agent/secrets/cp-service-token
+    mode: "0400"