R3b [fw]: delete legacy workflow-script/v1 composite and cp-service-token/v1 context (dbc5efc6)

Control plane 0.0.5.1890 no longer falls back to either. Invariant tests now
assert both stay gone.

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

tests/invariants/test_no_legacy_script_composite.py

@@ -0,0 +1,32 @@
+"""Track R / R3b: the legacy AU-51 bearer composite and layer stay deleted.
+
+``workflow-script/v1`` (the legacy script composite) and the
+``cp-service-token/v1`` context were removed once the control plane stopped
+falling back to them (agent-runtimes 0.0.5.1890). Nothing may re-introduce
+either, and no live composite may layer the bearer context.
+"""
+
+from pathlib import Path
+
+import yaml
+
+_ROOT = Path(__file__).resolve().parents[2]
+_HARNESSES = _ROOT / "harnesses"
+
+
+def test_legacy_script_composite_directory_is_gone():
+    assert not (_HARNESSES / "composites" / "workflow-script").exists()
+
+
+def test_cp_service_token_context_directory_is_gone():
+    assert not (_HARNESSES / "contexts" / "cp-service-token").exists()
+
+
+def test_no_composite_layers_cp_service_token():
+    offenders = []
+    for path in sorted((_HARNESSES / "composites").glob("*/v*/harness.yaml")):
+        doc = yaml.safe_load(path.read_text()) or {}
+        for layer in doc.get("layers") or []:
+            if str(layer.get("context", "")).startswith("cp-service-token"):
+                offenders.append(str(path.relative_to(_ROOT)))
+    assert offenders == []