fix(minimax,z-ai): write apiKeyHelper to agent home, mode 0444 for read

Mirrors agent-runtimes commit 166c19b. CRS serves these harness files to
dispatchers, so this repo must match.

Two fixes from the failing smoke test:

1. init.sh resolves the agent user's home via getent (init.sh runs as
   root, but claude runs as the agent user — different $HOME).
2. secrets_required mode "0400" → "0444" so the agent user can read the
   ESO-mounted secret via apiKeyHelper. The file is in pod-local tmpfs.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

harnesses/contexts/z-ai/v1/harness.yaml

@@ -15,7 +15,10 @@ secrets_required:
   - name: z-ai
     account_ref: "z-ai"
     mount_path: /run/agent/secrets/z-ai
-    mode: "0400"
+    # 0444 — readable by the agent user that runs `claude` (and thus
+    # apiKeyHelper). Pod-local tmpfs; "world readable" only means readable
+    # by processes in this pod.
+    mode: "0444"
 
 scripts:
   init: "./init.sh"