feat(templates): explicit cp_write on every kind: script node + audit test (WF-COMP-31d, item 26754227)

cp_write: true  -> state-tx (test-validate@1, frozen-fixture-emit@1) and, in
                   the archived bug-ancestor-auto-advance@1, tag-set + state-tx.
cp_write: false -> every other script node (verdict-gate, policy-pick,
                   preflight-*, frozen-fixture-emit, parent-link-check).
tests/invariants/test_cp_write_field_set_correctly.py pins the set.

HOLD: do not merge until the CP release that adds WorkflowNode.cp_write.
The current CP schema is extra="forbid" and rejects the new key
(verified: nodes.0.cp_write extra_forbidden), so on the old CP these
template edits are NOT inert.

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

task-templates/workflow/_archived/bug-ancestor-auto-advance@1.yaml

@@ -31,6 +31,7 @@ nodes:
   - id: parent-link-check
     kind: script
     cmd: scripts/workflow/parent-link-check
+    cp_write: false
     on_fail: refuse_dispatch
     runtime_env:
       CP_URL: "https://agents.oreillyit.nz/api"
@@ -42,6 +43,7 @@ nodes:
   - id: tag-ai-resolve
     kind: script
     cmd: scripts/workflow/tag-set
+    cp_write: true
     depends_on: [parent-link-check]
     on_fail: escalate
     runtime_env:
@@ -52,6 +54,7 @@ nodes:
   - id: state-tx
     kind: script
     cmd: scripts/workflow/state-tx
+    cp_write: true
     depends_on: [tag-ai-resolve]
     on_fail: escalate
     runtime_env:

task-templates/workflow/feature-delivery-loop@1.yaml

@@ -23,6 +23,7 @@ nodes:
   - id: policy-pick
     kind: script
     cmd: scripts/workflow/policy-pick
+    cp_write: false
     on_fail: escalate
   - id: agent
     kind: agent

task-templates/workflow/frozen-fixture-emit@1.yaml

@@ -18,10 +18,12 @@ nodes:
   - id: frozen-fixture-emit
     kind: script
     cmd: scripts/workflow/frozen-fixture-emit
+    cp_write: false
     on_fail: refuse_dispatch
   - id: state-tx
     kind: script
     cmd: scripts/workflow/state-tx
+    cp_write: true
     on_fail: continue
     runtime_env:
       CP_URL: "https://agents.oreillyit.nz/api"

task-templates/workflow/plan-review-loop@1.yaml

@@ -119,6 +119,7 @@ nodes:
   - id: judge-gate
     kind: script
     cmd: scripts/workflow/verdict-gate
+    cp_write: false
     depends_on: [judge-haiku]
 loop:
   body: [review-opus, review-minimax, improve-sonnet, judge-haiku, judge-gate]

task-templates/workflow/spec-review-loop@1.yaml

@@ -129,6 +129,7 @@ nodes:
   - id: judge-gate
     kind: script
     cmd: scripts/workflow/verdict-gate
+    cp_write: false
     depends_on: [judge-haiku]
 loop:
   body: [review-opus, review-minimax, improve-sonnet, judge-haiku, judge-gate]

task-templates/workflow/test-validate@1.yaml

@@ -18,18 +18,22 @@ nodes:
   - id: preflight-test-collection
     kind: script
     cmd: scripts/workflow/preflight-test-collection
+    cp_write: false
     on_fail: refuse_dispatch
   - id: preflight-fixture-lint
     kind: script
     cmd: scripts/workflow/preflight-fixture-lint
+    cp_write: false
     on_fail: refuse_dispatch
   - id: preflight-test-fail-mode
     kind: script
     cmd: scripts/workflow/preflight-test-fail-mode
+    cp_write: false
     on_fail: continue
   - id: state-tx
     kind: script
     cmd: scripts/workflow/state-tx
+    cp_write: true
     on_fail: continue
     runtime_env:
       CP_URL: "https://agents.oreillyit.nz/api"

task-templates/workflow/test-write-review-loop@1.yaml

@@ -61,6 +61,7 @@ nodes:
   - id: review-gate
     kind: script
     cmd: scripts/workflow/verdict-gate
+    cp_write: false
     depends_on: [review-sonnet]
 loop:
   body: [write-minimax, review-sonnet, review-gate]