feat(templates): explicit cp_write on every kind: script node + audit test (WF-COMP-31d, item 26754227)

cp_write: true  -> state-tx (test-validate@1, frozen-fixture-emit@1) and, in
                   the archived bug-ancestor-auto-advance@1, tag-set + state-tx.
cp_write: false -> every other script node (verdict-gate, policy-pick,
                   preflight-*, frozen-fixture-emit, parent-link-check).
tests/invariants/test_cp_write_field_set_correctly.py pins the set.

HOLD: do not merge until the CP release that adds WorkflowNode.cp_write.
The current CP schema is extra="forbid" and rejects the new key
(verified: nodes.0.cp_write extra_forbidden), so on the old CP these
template edits are NOT inert.

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

task-templates/workflow/test-validate@1.yaml

@@ -18,18 +18,22 @@ nodes:
   - id: preflight-test-collection
     kind: script
     cmd: scripts/workflow/preflight-test-collection
+    cp_write: false
     on_fail: refuse_dispatch
   - id: preflight-fixture-lint
     kind: script
     cmd: scripts/workflow/preflight-fixture-lint
+    cp_write: false
     on_fail: refuse_dispatch
   - id: preflight-test-fail-mode
     kind: script
     cmd: scripts/workflow/preflight-test-fail-mode
+    cp_write: false
     on_fail: continue
   - id: state-tx
     kind: script
     cmd: scripts/workflow/state-tx
+    cp_write: true
     on_fail: continue
     runtime_env:
       CP_URL: "https://agents.oreillyit.nz/api"