fix(minimax,z-ai): write apiKeyHelper to agent home, mode 0444 for read

Mirrors agent-runtimes commit 166c19b. CRS serves these harness files to
dispatchers, so this repo must match.

Two fixes from the failing smoke test:

1. init.sh resolves the agent user's home via getent (init.sh runs as
   root, but claude runs as the agent user — different $HOME).
2. secrets_required mode "0400" → "0444" so the agent user can read the
   ESO-mounted secret via apiKeyHelper. The file is in pod-local tmpfs.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

harnesses/contexts/minimax/v1/harness.yaml

@@ -18,7 +18,12 @@ secrets_required:
   - name: minimax
     account_ref: "minimax"
     mount_path: /run/agent/secrets/minimax
-    mode: "0400"
+    # 0444 — readable by the agent user that runs `claude` (and thus
+    # apiKeyHelper). The pod has no fsGroup, so the kubelet mounts the
+    # secret as root:root; mode 0400 would block the legitimate read.
+    # The file lives in pod-local tmpfs — "world readable" only means
+    # readable by other processes in this same pod, which we control.
+    mode: "0444"
 
 scripts:
   init: ./init.sh