fix(repo-readonly): clone when /workspace/project is empty, not only when absent (bug eede60c3)

harness_init pre-creates an empty /workspace/project, so the -d guard always skipped the clone.

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

harnesses/contexts/repo-readonly/v1/init.sh

@@ -42,12 +42,13 @@ if [ -z "${AGENT_REPO_URL:-}" ]; then
     exit 0
 fi
 
-# If the clone target already exists (e.g. a previous layer cloned into
-# it), skip — never clobber. The framework composite order
-# (shared-variables/v1 first, cp-service-token/v1 second,
-# repo-readonly/v1 last) guarantees neither prior layer writes here.
-if [ -d /workspace/project ]; then
-    echo "/workspace/project already exists; skipping clone."
+# If the clone target already has content (e.g. a previous layer cloned
+# into it), skip — never clobber. The check is on NON-EMPTY, not on
+# existence: entrypoint/harness_init.py always pre-creates an empty
+# /workspace/project, so a bare -d test skipped the clone every time
+# (bug eede60c3). git clone into an existing empty directory is valid.
+if [ -d /workspace/project ] && [ -n "$(ls -A /workspace/project 2>/dev/null)" ]; then
+    echo "/workspace/project already populated; skipping clone."
     exit 0
 fi