fix(harnesses): migrate to ESO secrets_required form, mirror agent-runtimes

The CRS-served harnesses still carried `secrets_files: [{encrypted: true}]`
which now hard-fails on H-SECRET-1 ("SOPS-encrypted secrets_files entries
are no longer permitted") in the dispatcher's harness validator. Sync the
8 provider harnesses with the agent-runtimes copies: same `secrets_required`
shape, same `init.sh` (ESO-mounted file paths), same `bin/` wrappers.

Use bare `account_ref: "<provider>"` (not `<provider>.cp:cp` — that
scope-kind isn't valid per SR-DISP-1-FIELD).

Provider key names follow the per-provider schema as emitted by the CP
provisioner: minimax/airouter/z-ai → api_key; gitea-https/gitea-admin →
{token,base_url,username}; gitea-ssh* → {host,private_key}.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

harnesses/contexts/z-ai/v1/init.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+# z-ai harness init — verifies ESO secret mount exists
+# M22 Phase 9 Wave 4
+set -euo pipefail
+
+echo "=== z-ai/v1 init ==="
+
+SECRETS_DIR="/run/agent/secrets/z-ai"
+if [ ! -d "$SECRETS_DIR" ]; then
+    echo "ERROR: ESO secret mount not found at $SECRETS_DIR" >&2
+    echo "Has the dispatcher been configured with ESO-managed secrets?" >&2
+    exit 1
+fi
+
+echo "z-ai ESO secret mount verified at $SECRETS_DIR"
+echo "=== z-ai/v1 init complete ==="