feat(harnesses): add customer-script/v1 composite

Minimal harness for kind: customer_script nodes (agent-runtimes
spec/tenant-namespaces.md SCR-1..SCR-6). No LLM turn - runs via the
"shell" runner, agent-repo/v1 clone access only. Per-script credential
needs are deliberately not baked into this base (SCR-6: narrow,
per-script review) - compose a customer-script-<need>/v1 variant
layering whichever specific credential context a given script actually
needs, rather than widening this shared base.

Without this commit, kind: customer_script was not dispatchable from
any machine other than the one it was authored on - the harness lookup
against a fresh CRS sync would fail.

Claude-Session: https://claude.ai/code/session_012arAwUuBQrpnMzJ36mEVBk

harnesses/composites/customer-script/v1/harness.yaml

@@ -0,0 +1,16 @@
+kind: composite
+name: customer-script
+version: 1
+description: >-
+  Minimal harness for customer-authored `kind: customer_script` nodes
+  (spec/tenant-namespaces.md SCR-1..SCR-6 in agent-runtimes). No LLM turn —
+  runs via the "shell" runner, agent-repo/v1 clone access only. Per-script
+  credential/secret needs are deliberately NOT baked into this base (SCR-6:
+  "an explicit, narrow allowlist... reviewed per script, not inherited
+  wholesale") — compose a `customer-script-<need>/v1` variant layering
+  whichever specific git-credential context (e.g. gitea-ssh/v1, or a
+  read-only variant) and/or `secrets_required` account_ref entries a given
+  script actually needs, rather than widening this shared base.
+
+layers:
+  - context: agent-repo/v1