fix(harnesses): migrate to ESO secrets_required form, mirror agent-runtimes

The CRS-served harnesses still carried `secrets_files: [{encrypted: true}]`
which now hard-fails on H-SECRET-1 ("SOPS-encrypted secrets_files entries
are no longer permitted") in the dispatcher's harness validator. Sync the
8 provider harnesses with the agent-runtimes copies: same `secrets_required`
shape, same `init.sh` (ESO-mounted file paths), same `bin/` wrappers.

Use bare `account_ref: "<provider>"` (not `<provider>.cp:cp` — that
scope-kind isn't valid per SR-DISP-1-FIELD).

Provider key names follow the per-provider schema as emitted by the CP
provisioner: minimax/airouter/z-ai → api_key; gitea-https/gitea-admin →
{token,base_url,username}; gitea-ssh* → {host,private_key}.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

harnesses/contexts/airouter/v1/bin/anthropic-compat-wrapper.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+# Anthropic-compat wrapper for airouter harness (Phase 9 ESO-managed secrets)
+# Reads airouter credentials from /run/agent/secrets/airouter/ and passes them
+# as env vars to the underlying Claude runner.
+set -euo pipefail
+
+exec env \
+  ANTHROPIC_AUTH_TOKEN="$(cat /run/agent/secrets/airouter/auth_token)" \
+  ANTHROPIC_BASE_URL="$(cat /run/agent/secrets/airouter/base_url)" \
+  claude "$@"

harnesses/contexts/airouter/v1/harness.yaml

@@ -8,7 +8,11 @@ provides: [agentic-runner]
 env:
   OPENAI_BASE_URL: "https://api.airouter.ch/v1"
 
-secrets_files:
-  - source: ./provider.sops.env
-    target: /opt/harness/secrets/airouter/provider.sops.env
-    encrypted: true
+secrets_required:
+  - name: airouter
+    account_ref: "airouter"
+    mount_path: /run/agent/secrets/airouter
+    mode: "0400"
+
+scripts:
+  init: ./init.sh

harnesses/contexts/airouter/v1/init.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# airouter init — Phase 9 ESO-managed secret mount.
+#
+# Verifies the ESO-mounted secret files exist; the wrapper
+# (`bin/anthropic-compat-wrapper.sh`) reads them at exec time.
+#
+# Per H-SECRET-4: NO `export` of credentials here. The earlier draft of this
+# file exported ANTHROPIC_AUTH_TOKEN and ANTHROPIC_BASE_URL from this script,
+# which runs as root under uid-wrapper.sh — even though the export was
+# subshell-scoped, the secret was briefly resident in /proc/<pid>/environ of
+# a root process. The wrapper's `exec env VAR=...` pattern is the only
+# acceptable credential delivery point.
+set -euo pipefail
+
+SECRETS_DIR="/run/agent/secrets/airouter"
+
+if [ ! -d "$SECRETS_DIR" ]; then
+    echo "ERROR: Secret directory $SECRETS_DIR not found. ESO mount may have failed." >&2
+    exit 1
+fi
+
+for f in auth_token base_url; do
+    if [ ! -r "$SECRETS_DIR/$f" ]; then
+        echo "ERROR: $SECRETS_DIR/$f not readable. Check ESO ExternalSecret for airouter." >&2
+        exit 1
+    fi
+done
+
+echo "airouter secrets verified at $SECRETS_DIR"