feat: hugo-content-workspace + hugo-content-airouter harnesses

New context: hugo-content-workspace/v1
- init.sh: clones hugo-{customer}-content at HUGO_CONTENT_BRANCH and
  hugo-{customer}-integration at main via gitea-ssh-accelerators
- finalize.sh: detects changes, commits content repo first then
  integration repo; skips silently if no changes
- CLAUDE.md: instructs the agent to work in /workspace/content/

New composite: hugo-content-airouter/v1
- Combines airouter/v1 + gitea-ssh-accelerators/v1 + hugo-content-workspace/v1
- Label-gated to airouter dispatchers (ESO secret required)

Used by cms-proxy /ai/{customer}/draft endpoint.

harnesses/composites/hugo-content-airouter/v1/harness.yaml

@@ -0,0 +1,12 @@
+kind: composite
+name: hugo-content-airouter
+version: 1
+description: "Hugo content AI assistant — Airouter model + Gitea SSH + content/integration repo clone"
+
+# Airouter label gate — only dispatchers with the ESO airouter secret claim these tasks.
+requires_labels: [airouter]
+
+layers:
+  - context: airouter/v1
+  - context: gitea-ssh-accelerators/v1
+  - context: hugo-content-workspace/v1