Merge pull request 'workflow-script-nocp-norepo/v1: secret-free script composite' (#5) from feat/script-composite-norepo into main

harnesses/composites/workflow-script-nocp-norepo/v1/harness.yaml

@@ -0,0 +1,14 @@
+kind: composite
+name: workflow-script-nocp-norepo
+version: 1
+description: "Internal composite for kind: script nodes with cp_write=false and NO effective agent_repo (typed-workflows WF-COMP-31e, planner item e993c9fa). Brings only the shared-variables filesystem context: no repo-readonly clone, no CP credential, and therefore ZERO secrets_required entries. That makes the node eligible for an M45 tenant namespace (the NS-12 gate rejects any ESO account secret) and for the M33 egress broker sidecar, which supplies the node's credentials through bindings. Not model-bearing; the compiled shape is cli=\"shell\", params.cmd=<cmd>."
+
+# Counterpart of workflow-script-nocp/v1 for templates that declare no agent_repo.
+# The compiler (controlplane/script_composites.py resolve_script_composite) selects
+# this only when effective_repo is False; with AGENT_REPO_URL unset the entrypoint
+# V2 guard does not require /workspace/project. Never layer repo-readonly/v1 here:
+# its gitea-ssh-readonly secret is exactly what this composite exists to avoid.
+layers:
+  # spec/workflow-variables.md WV-19 / spec/harness.md HD-14 — provides the
+  # [shared-variables] tag.
+  - context: shared-variables/v1