fix(harnesses): migrate to ESO secrets_required form, mirror agent-runtimes

The CRS-served harnesses still carried `secrets_files: [{encrypted: true}]`
which now hard-fails on H-SECRET-1 ("SOPS-encrypted secrets_files entries
are no longer permitted") in the dispatcher's harness validator. Sync the
8 provider harnesses with the agent-runtimes copies: same `secrets_required`
shape, same `init.sh` (ESO-mounted file paths), same `bin/` wrappers.

Use bare `account_ref: "<provider>"` (not `<provider>.cp:cp` — that
scope-kind isn't valid per SR-DISP-1-FIELD).

Provider key names follow the per-provider schema as emitted by the CP
provisioner: minimax/airouter/z-ai → api_key; gitea-https/gitea-admin →
{token,base_url,username}; gitea-ssh* → {host,private_key}.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

harnesses/contexts/gitea-https/v1/harness.yaml

@@ -12,7 +12,8 @@ git_identity:
 scripts:
   init: "./init.sh"
 
-secrets_files:
-  - source: ./provider.sops.env
-    target: /opt/harness/secrets/gitea-https/provider.sops.env
-    encrypted: true
+secrets_required:
+  - name: gitea-https
+    account_ref: "gitea-https"
+    mount_path: /run/agent/secrets/gitea-https
+    mode: "0400"

harnesses/contexts/gitea-https/v1/init.sh

@@ -1,8 +1,8 @@
 #!/bin/bash
-# Configure git to use GITEA_TOKEN for HTTPS cloning/pushing to gitea.oreillyit.nz
+# Configure git to use git credential helper for gitea.oreillyit.nz via HTTPS.
 #
-# Uses a credential helper script that reads the token from the environment.
-# This avoids embedding the token in clone URLs (which would appear in logs).
+# The token is read from /run/agent/secrets/gitea-https/token at every git
+# invocation (not at init time). This avoids the token appearing in logs.
 
 set -euo pipefail
 
@@ -11,14 +11,16 @@ CRED_HELPER="/opt/harness/contexts/gitea-https/v1/git-credential-gitea.sh"
 # Create the credential helper script
 cat > "$CRED_HELPER" << 'HELPER_EOF'
 #!/bin/bash
-# Git credential helper that provides GITEA_TOKEN for gitea.oreillyit.nz
-if [ -z "${GITEA_TOKEN:-}" ]; then
-    exit 1
-fi
+# Git credential helper that provides the token from a mounted file
+# for gitea.oreillyit.nz.
+# This reads the file at EVERY git invocation, not at init time.
+set -euo pipefail
+SECRET_FILE=/run/agent/secrets/gitea-https/token
+[ -r "$SECRET_FILE" ] || exit 1
 echo "protocol=https"
 echo "host=gitea.oreillyit.nz"
 echo "username=token"
-echo "password=${GITEA_TOKEN}"
+echo "password=$(cat $SECRET_FILE)"
 HELPER_EOF
 
 chmod +x "$CRED_HELPER"
@@ -26,4 +28,4 @@ chmod +x "$CRED_HELPER"
 # Configure git to use this credential helper for gitea.oreillyit.nz
 git config --global credential.https://gitea.oreillyit.nz.helper "$CRED_HELPER"
 
-echo "Git HTTPS credential helper configured for gitea.oreillyit.nz"
+echo "Git HTTPS credential helper configured for gitea.oreillyit.nz"