feat(harness): repo-readonly/v1 + gitea-ssh layer in workflow-script/v1; agent_repo on test-validate/frozen-fixture-emit (WF-COMP-34, bug 3bee78fa/a3ba44bc)

harnesses/composites/workflow-script/v1/harness.yaml

@@ -21,4 +21,16 @@ layers:
   # on the entrypoint process environment before shell_runner runs (entrypoint reads
   # os.environ via env=os.environ.copy() in subprocess.run at entrypoint/runners/shell.py:73,
   # so the same credential channel an agent node gets reaches a script node unchanged).
-  - context: cp-service-token/v1
+  - context: cp-service-token/v1
+  # spec/typed-workflows.md WF-COMP-34 (bug 3bee78fa, 2026-10-02) — read-only
+  # project-repo clone for harness-path kind: script nodes. Layered LAST so
+  # its clone runs after the two AU-51 wiring layers and before the script
+  # starts (init.sh order: shared-variables -> cp-service-token -> repo-readonly).
+  # When AGENT_REPO_URL is unset (the pre-fix runtime, or any template that
+  # does not declare agent_repo) this layer is a no-op; the V2 guard
+  # (entrypoint/entrypoint.py:901-906) does NOT trip because the unset case
+  # is a no-op there too. Layered-in instead of layering agent-repo/v1
+  # because that context's fork management and push side effects are wrong
+  # for a read-only script node (see bug item body).
+  - context: gitea-ssh/v1
+  - context: repo-readonly/v1