feat: STATE_TX_FROM_STATES on state-tx nodes; workflow-script composite invariant; refresh legacy-mount NOTE

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

tests/invariants/test_workflow_script_composite_layers.py

@@ -0,0 +1,34 @@
+"""workflow-script/v1 composite: exact layer order and credential env export.
+
+Script nodes get their CP write credential only through this composite
+(the legacy WF-COMP-26 mount is removed), so the layering is load-bearing.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import yaml
+
+_ROOT = Path(__file__).resolve().parents[2] / "harnesses"
+
+
+def _load(kind_dir: str, name: str) -> dict:
+    return yaml.safe_load((_ROOT / kind_dir / name / "v1" / "harness.yaml").read_text())
+
+
+def test_workflow_script_layers_shared_variables_then_cp_service_token():
+    doc = _load("composites", "workflow-script")
+    assert doc["layers"] == [
+        {"context": "shared-variables/v1"},
+        {"context": "cp-service-token/v1"},
+    ]
+
+
+def test_workflow_script_env_exports_cp_service_token_file():
+    doc = _load("composites", "workflow-script")
+    env: dict = dict(doc.get("env") or {})
+    for layer in doc["layers"]:
+        (kind, ref), = layer.items()
+        name = ref.split("/")[0]
+        env.update(_load(kind + "s", name).get("env") or {})
+    assert env["CP_SERVICE_TOKEN_FILE"] == "/run/agent/cp-service-token/token"