harness(HC-11): declare write_targets on the four forge-credential layers (gitea-admin, gitea-ssh, gitea-ssh-accelerators, gitea-ssh-homelab) (b1de17b4)

Held locally until the agent-runtimes HC-11 composer change is deployed: the live composer is extra=forbid and would reject the new key.

Claude-Session: https://claude.ai/code/session_018LRh1S2bHJYhEgrMu3UJx8

harnesses/contexts/gitea-admin/v1/harness.yaml

@@ -4,6 +4,9 @@ version: 1
 description: "Gitea admin: SSH, git identity, API token for skynet org"
 requires: []
 provides: [gitea-admin]
+# HC-11: repos this layer's forge credential may push to (host-qualified; CRS-103 gate).
+write_targets:
+  - "gitea.oreillyit.nz/skynet/*"
 
 git_identity:
   name: "agent-runtimes"

harnesses/contexts/gitea-ssh-accelerators/v1/harness.yaml

@@ -4,6 +4,9 @@ version: 1
 description: "Gitea SSH: clone/push via SSH key for gitea.oreillyit.nz (accelerator_automation / accelerators org)"
 requires: []
 provides: [git-access]
+# HC-11: repos this layer's forge credential may push to (host-qualified; CRS-103 gate).
+write_targets:
+  - "gitea.oreillyit.nz/accelerators/*"
 
 git_identity:
   name: "agent-runtimes"

harnesses/contexts/gitea-ssh-homelab/v1/harness.yaml

@@ -4,6 +4,9 @@ version: 1
 description: "Gitea SSH: clone/push via SSH key for gitea.oreillyit.nz (cluster-administrator / homelab org)"
 requires: []
 provides: [git-access]
+# HC-11: repos this layer's forge credential may push to (host-qualified; CRS-103 gate).
+write_targets:
+  - "gitea.oreillyit.nz/homelab/*"
 
 git_identity:
   name: "agent-runtimes"

harnesses/contexts/gitea-ssh/v1/harness.yaml

@@ -4,6 +4,9 @@ version: 1
 description: "Gitea SSH: clone/push via SSH key for gitea.oreillyit.nz (ai_enablement)"
 requires: []
 provides: [git-access]
+# HC-11: repos this layer's forge credential may push to (host-qualified; CRS-103 gate).
+write_targets:
+  - "gitea.oreillyit.nz/skynet/*"
 
 git_identity:
   name: "agent-runtimes"