fix(harnesses): migrate to ESO secrets_required form, mirror agent-runtimes

The CRS-served harnesses still carried `secrets_files: [{encrypted: true}]`
which now hard-fails on H-SECRET-1 ("SOPS-encrypted secrets_files entries
are no longer permitted") in the dispatcher's harness validator. Sync the
8 provider harnesses with the agent-runtimes copies: same `secrets_required`
shape, same `init.sh` (ESO-mounted file paths), same `bin/` wrappers.

Use bare `account_ref: "<provider>"` (not `<provider>.cp:cp` — that
scope-kind isn't valid per SR-DISP-1-FIELD).

Provider key names follow the per-provider schema as emitted by the CP
provisioner: minimax/airouter/z-ai → api_key; gitea-https/gitea-admin →
{token,base_url,username}; gitea-ssh* → {host,private_key}.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

harnesses/contexts/gitea-ssh-homelab/v1/harness.yaml

@@ -18,7 +18,8 @@ ssh_hosts:
 scripts:
   init: "./init.sh"
 
-secrets_files:
-  - source: ./ssh-key.sops.env
-    target: /opt/harness/secrets/gitea-ssh-homelab/ssh-key.sops.env
-    encrypted: true
+secrets_required:
+  - name: gitea-ssh-homelab
+    account_ref: "gitea-ssh-homelab"
+    mount_path: /run/agent/secrets/gitea-ssh-homelab
+    mode: "0400"

harnesses/contexts/gitea-ssh-homelab/v1/init.sh

@@ -1,29 +1,30 @@
 #!/bin/bash
+# gitea-ssh-homelab init: copy the ESO-mounted SSH key to the path the
+# harness-init `~/.ssh/config` expects.
+#
+# The harness-init dispatcher (`entrypoint/harness_init.py`) writes
+# `~/.ssh/config` from the harness's `ssh_hosts:` block; for this provider
+# the entry is `Host gitea.oreillyit.nz-homelab` with
+# `IdentityFile /home/agent/.ssh/gitea-oreillyit-nz-homelab`.
+#
+# We only need to materialise the key file at that path. We MUST NOT append
+# our own SSH config block — doing so would (a) duplicate harness-init's
+# config (SSH first-match-wins, so the appended block becomes dead) and
+# (b) any unaliased `Host gitea.oreillyit.nz` block would collide with
+# other gitea harnesses (gitea-https, gitea-admin) when composed.
+#
+# Per H-SECRET-4: NO `export` of credentials here. The path to the key is
+# not a secret; the key content is, and it stays in the file.
 set -euo pipefail
 
-# Extract SSH private key from decrypted env file for the homelab identity.
-# The meta-init script generates ~/.ssh/config with
-# IdentityFile /home/agent/.ssh/gitea-oreillyit-nz-homelab
-# matching the ssh_hosts alias in harness.yaml.
+SSH_KEY_SRC="/run/agent/secrets/gitea-ssh-homelab/id_ed25519"
+SSH_KEY_DST="/home/agent/.ssh/gitea-oreillyit-nz-homelab"
 
-SSH_KEY_FILE="/home/agent/.ssh/gitea-oreillyit-nz-homelab"
-
-for env_file in /opt/harness/secrets/gitea-ssh-homelab/*.decrypted.env /opt/harness/secrets/gitea-ssh-homelab/*.env; do
-    [ -f "$env_file" ] || continue
-    while IFS='=' read -r key value; do
-        [[ "$key" =~ ^[[:space:]]*# ]] && continue
-        [[ -z "$key" ]] && continue
-        if [ "$key" = "GITEA_SSH_KEY" ]; then
-            mkdir -p /home/agent/.ssh
-            echo "$value" | base64 -d > "$SSH_KEY_FILE"
-            chmod 600 "$SSH_KEY_FILE"
-            chown agent:agent "$SSH_KEY_FILE"
-            echo "SSH key written to $SSH_KEY_FILE"
-            break 2
-        fi
-    done < "$env_file"
-done
-
-if [ ! -f "$SSH_KEY_FILE" ]; then
-    echo "WARNING: GITEA_SSH_KEY not found in any env file under /opt/harness/secrets/gitea-ssh-homelab/"
+if [ ! -r "$SSH_KEY_SRC" ]; then
+    echo "ERROR: SSH key not found at $SSH_KEY_SRC — ESO ExternalSecret not Ready?" >&2
+    exit 1
 fi
+
+mkdir -p /home/agent/.ssh
+install -m 0600 -o agent -g agent "$SSH_KEY_SRC" "$SSH_KEY_DST"
+echo "gitea-ssh-homelab: SSH key staged at $SSH_KEY_DST (0600 agent:agent)"