fix(harnesses): migrate to ESO secrets_required form, mirror agent-runtimes

The CRS-served harnesses still carried `secrets_files: [{encrypted: true}]`
which now hard-fails on H-SECRET-1 ("SOPS-encrypted secrets_files entries
are no longer permitted") in the dispatcher's harness validator. Sync the
8 provider harnesses with the agent-runtimes copies: same `secrets_required`
shape, same `init.sh` (ESO-mounted file paths), same `bin/` wrappers.

Use bare `account_ref: "<provider>"` (not `<provider>.cp:cp` — that
scope-kind isn't valid per SR-DISP-1-FIELD).

Provider key names follow the per-provider schema as emitted by the CP
provisioner: minimax/airouter/z-ai → api_key; gitea-https/gitea-admin →
{token,base_url,username}; gitea-ssh* → {host,private_key}.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

harnesses/contexts/minimax/v1/bin/anthropic-compat-wrapper.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# Anthropic-compat wrapper for MiniMax (Phase 9 ESO-managed secrets).
+# Reads the api_key file and passes it as ANTHROPIC_AUTH_TOKEN to claude.
+# ANTHROPIC_BASE_URL is set in harness.yaml `env:` and flows through.
+set -euo pipefail
+
+exec env \
+  ANTHROPIC_AUTH_TOKEN="$(cat /run/agent/secrets/minimax/api_key)" \
+  claude "$@"

harnesses/contexts/minimax/v1/harness.yaml

@@ -11,9 +11,13 @@ env:
   CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
   DISABLE_PROMPT_CACHING: "1"
 
-secrets_files:
-  - source: ./provider.sops.env
-    target: /opt/harness/secrets/minimax/provider.sops.env
-    encrypted: true
+secrets_required:
+  - name: minimax
+    account_ref: "minimax"
+    mount_path: /run/agent/secrets/minimax
+    mode: "0400"
 
-# TODO: Add network_hosts for api.minimax.io when context harnesses support it
+scripts:
+  init: ./init.sh
+
+# TODO: Add network_hosts for api.minimax.io when context harnesses support it

harnesses/contexts/minimax/v1/init.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+set -euo pipefail
+
+# Verify the ESO-managed MiniMax api_key file is mounted. The wrapper
+# (`bin/anthropic-compat-wrapper.sh`) reads it at exec time and exports
+# ANTHROPIC_AUTH_TOKEN to the claude subprocess.
+#
+# ANTHROPIC_BASE_URL is set in harness.yaml `env:` (not in the K8s Secret),
+# so no file check is required for it.
+
+API_KEY_FILE="/run/agent/secrets/minimax/api_key"
+
+if [ ! -r "$API_KEY_FILE" ]; then
+    echo "ERROR: $API_KEY_FILE not readable. Check ESO ExternalSecret acct-<minimax-id>." >&2
+    exit 1
+fi
+
+echo "minimax api_key verified at $API_KEY_FILE"