feat(cp-harness): migrate from agent-runtimes/harnesses/

The agent-runtimes repo is moving to a CRS-only harness model: dispatcher
images stop baking in /app/harnesses/ and discover them via CRS at runtime.
cp-harness was the only harness that lived only in the agent-runtimes
checkout (created in M16 Phase 1 D4, commit c1df4cc) — copied here so
nothing is lost in the cutover.

cp-harness has no current consumers (no composite or template references
it); it is infrastructure for the future M16 self-orchestration api_key
submission flow.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

harnesses/contexts/cp-harness/v1/harness.yaml

@@ -0,0 +1,12 @@
+kind: context
+name: cp-harness
+version: 1
+description: "Agent CP harness - provides CP token auth via tmpfs mount and prompt-injection defence"
+provides: [agent-cp-harness]
+env: {}
+secrets_files:
+  - source: ./cp-token.sops.env
+    target: /run/secrets/cp-token
+    encrypted: true
+    tmpfs: true
+    mode: "0400"