fix(b22a): bare account_ref for anthropic-cloud-paul-oauth harness

Same bug as upstream agent-runtimes: scoped form never matched
because the dispatcher does literal scope.id compare and
owner_principal_id stores the user UUID, not 'paul'.

Pairs with PATCH /v1/accounts/{id} renaming the live account_label
to 'anthropic-cloud-paul-oauth' so the bare ref resolves uniquely.

Closes BUG-22a.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

harnesses/contexts/anthropic-cloud-paul-oauth/v1/harness.yaml

@@ -13,6 +13,6 @@ scripts:
 
 secrets_required:
   - name: anthropic-cloud-paul-oauth
-    account_ref: "anthropic-cloud-paul-oauth.user:paul"
+    account_ref: "anthropic-cloud-paul-oauth"
     mount_path: /run/agent/secrets/anthropic-cloud-paul-oauth
     mode: "0400"