fix: declare runtime_env on state-tx nodes in test-validate@1 and frozen-fixture-emit@1

state-tx exits 2 without CP_URL and STATE_TX_NEW_STATE. Each template's
target state is its own output.state (test-validated / test-skeleton-ready).
Adds an invariant test.

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

task-templates/workflow/frozen-fixture-emit@1.yaml

@@ -21,3 +21,6 @@ nodes:
     kind: script
     cmd: scripts/workflow/state-tx
     on_fail: continue
+    runtime_env:
+      CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
+      STATE_TX_NEW_STATE: test-skeleton-ready

task-templates/workflow/test-validate@1.yaml

@@ -29,3 +29,6 @@ nodes:
     kind: script
     cmd: scripts/workflow/state-tx
     on_fail: continue
+    runtime_env:
+      CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
+      STATE_TX_NEW_STATE: test-validated

tests/invariants/test_state_tx_runtime_env.py

@@ -0,0 +1,29 @@
+"""state-tx script nodes must declare CP_URL and STATE_TX_NEW_STATE.
+
+scripts/workflow/state-tx fails with exit 2 when either is missing.
+CP_SERVICE_TOKEN_FILE is supplied by the workflow-script/v1 composite, not
+runtime_env, and must not be declared here. STATE_TX_NEW_STATE must equal the
+template's own output.state.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+import yaml
+
+_DIR = Path(__file__).resolve().parents[2] / "task-templates" / "workflow"
+
+
+@pytest.mark.parametrize(
+    "name", ["test-validate@1.yaml", "frozen-fixture-emit@1.yaml"]
+)
+def test_state_tx_node_declares_required_runtime_env(name):
+    doc = yaml.safe_load((_DIR / name).read_text())
+    nodes = [n for n in doc["nodes"] if n.get("cmd") == "scripts/workflow/state-tx"]
+    assert len(nodes) == 1
+    env = nodes[0].get("runtime_env") or {}
+    assert env.get("CP_URL")
+    assert env.get("STATE_TX_NEW_STATE") == doc["output"]["state"]
+    assert "CP_SERVICE_TOKEN_FILE" not in env
+    assert not any(k.startswith("OIDC_") for k in env)