R3b [fw]: delete legacy workflow-script/v1 composite and cp-service-token/v1 context (dbc5efc6)

Control plane 0.0.5.1890 no longer falls back to either. Invariant tests now
assert both stay gone.

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

harnesses/composites/workflow-script/v1/harness.yaml

@@ -1,35 +0,0 @@
-kind: composite
-name: workflow-script
-version: 1
-description: "Internal composite for the flag-on kind: script path (typed-workflows WF-COMP-31 / workflow-variables WV-19). Brings the shared-variables filesystem context AND the AU-51 CP write credential (cp-service-token/v1 sets CP_SERVICE_TOKEN_FILE in the entrypoint process env before shell_runner runs). NOT a model-bearing composite — the kind: script compiled shape is cli=\"shell\", params.cmd=<cmd>; this composite provides the harness layers that path needs and nothing else."
-
-# Order matters only for HC-6 env last-writer-wins / HC-8 git identity. The two
-# layers here have disjoint env vars (shared-variables sets WORKFLOW_VARIABLES_*
-# paths, cp-service-token sets CP_SERVICE_TOKEN_FILE) and no overlapping git
-# identity, so the listed order has no observable merge effect — both layers
-# reach the script-node container either way.
-layers:
-  # spec/workflow-variables.md WV-19 / spec/harness.md HD-14 — agent-facing
-  # /variables/ context (CLAUDE.md mounted at /opt/harness/context/shared-variables/CLAUDE.md)
-  # plus WORKFLOW_VARIABLES_ROOT=/variables and templated WORKFLOW_VARIABLES_SELF=<step_path>.
-  # Provides the [shared-variables] tag used by the dispatcher's extra_layers injection.
-  - context: shared-variables/v1
-  # spec/typed-workflows.md WF-COMP-31 "AU-51 credential env seam" — this layer's
-  # init.sh restages the ESO-mounted CP-service-token secret (root-owned mode 0400)
-  # to an agent-owned 0600 copy at /run/agent/cp-service-token/token and exports
-  # CP_SERVICE_TOKEN_FILE pointing at it. Verified: env.CP_SERVICE_TOKEN_FILE is set
-  # on the entrypoint process environment before shell_runner runs (entrypoint reads
-  # os.environ via env=os.environ.copy() in subprocess.run at entrypoint/runners/shell.py:73,
-  # so the same credential channel an agent node gets reaches a script node unchanged).
-  - context: cp-service-token/v1
-  # spec/typed-workflows.md WF-COMP-34 (bug 3bee78fa, 2026-10-02) — read-only
-  # project-repo clone for harness-path kind: script nodes. Layered LAST so
-  # its clone runs after the two AU-51 wiring layers and before the script
-  # starts (init.sh order: shared-variables -> cp-service-token -> repo-readonly).
-  # When AGENT_REPO_URL is unset (the pre-fix runtime, or any template that
-  # does not declare agent_repo) this layer is a no-op; the V2 guard
-  # (entrypoint/entrypoint.py:901-906) does NOT trip because the unset case
-  # is a no-op there too. Layered-in instead of layering agent-repo/v1
-  # because that context's fork management and push side effects are wrong
-  # for a read-only script node (see bug item body).
-  - context: repo-readonly/v1

harnesses/contexts/cp-service-token/v1/harness.yaml

@@ -1,30 +0,0 @@
-kind: context
-name: cp-service-token
-version: 1
-description: "CP-internal service bearer token — authenticates agent-container write calls back to the control plane (AU-51/AU-51b, bug b3a96acc)"
-requires: []
-provides: []
-
-# AU-51b: the ESO-mounted secret is root-owned mode 0400 (init.sh runs as
-# root, before the gosu drop to the agent user, uid 1000) — unreadable by
-# the agent process directly. Confirmed live 2026-09-03: a real agent
-# session hit exactly this ("cp-cli invocation can't proceed... token is
-# root-owned mode 0400 so it's not readable by the agent user"). Mirrors
-# anthropic-cloud-paul-oauth/v1's pattern: init.sh restages a 0600
-# agent-owned copy outside the ESO mount. CP_SERVICE_TOKEN_FILE points at
-# the restaged copy, not the raw mount.
-#
-# The value at this path MUST match the CP's CP_INTERNAL_BEARER_TOKEN
-# (same account: cp-decompose-service-token, account_id
-# 1d963673-6ac9-4f85-875a-2ce5323e76ad, owner (cp, cp)).
-env:
-  CP_SERVICE_TOKEN_FILE: /run/agent/cp-service-token/token
-
-scripts:
-  init: "./init.sh"
-
-secrets_required:
-  - name: cp-service-token
-    account_ref: "1d963673-6ac9-4f85-875a-2ce5323e76ad"
-    mount_path: /run/agent/secrets/cp-service-token
-    mode: "0400"

harnesses/contexts/cp-service-token/v1/init.sh

@@ -1,39 +0,0 @@
-#!/bin/bash
-# cp-service-token init — restage the ESO-mounted secret to an agent-owned
-# copy.
-#
-# Threat model: keep the ESO mount root-only (mode 0400) so the agent user
-# cannot directly `cat` /run/agent/secrets/cp-service-token/*. init.sh runs
-# as root (in uid-wrapper.sh, before the gosu drop) and writes a restaged
-# copy at /run/agent/cp-service-token/token with mode 0600 owned by the
-# agent user. This mirrors anthropic-cloud-paul-oauth/v1/init.sh's pattern.
-#
-# Bug discovered live 2026-09-03: without this restaging step, cp-cli
-# (invoked by the agent user, uid 1000) could not read the raw 0400
-# root-owned mount at all — "cp_cli invocation can't proceed... token is
-# root-owned mode 0400 so it's not readable by the agent user". The context
-# originally set CP_SERVICE_TOKEN_FILE directly at the raw ESO mount path,
-# which is the mistake this init.sh fixes.
-
-set -euo pipefail
-
-ESO_TOKEN="/run/agent/secrets/cp-service-token/value"
-
-if [ ! -r "$ESO_TOKEN" ]; then
-    echo "ERROR: $ESO_TOKEN not readable. Check ESO ExternalSecret acct-1d963673." >&2
-    exit 1
-fi
-
-AGENT_USER="${AGENT_USER:-agent}"
-
-DEST_DIR="/run/agent/cp-service-token"
-mkdir -p "$DEST_DIR"
-
-DEST_FILE="$DEST_DIR/token"
-cp "$ESO_TOKEN" "$DEST_FILE"
-
-chown "$AGENT_USER:" "$DEST_DIR" "$DEST_FILE" 2>/dev/null || true
-chmod 0700 "$DEST_DIR"
-chmod 0600 "$DEST_FILE"
-
-echo "cp-service-token: restaged into $DEST_FILE (0600 $AGENT_USER:$AGENT_USER)"