feat: hugo-content-workspace + hugo-content-airouter harnesses

New context: hugo-content-workspace/v1
- init.sh: clones hugo-{customer}-content at HUGO_CONTENT_BRANCH and
  hugo-{customer}-integration at main via gitea-ssh-accelerators
- finalize.sh: detects changes, commits content repo first then
  integration repo; skips silently if no changes
- CLAUDE.md: instructs the agent to work in /workspace/content/

New composite: hugo-content-airouter/v1
- Combines airouter/v1 + gitea-ssh-accelerators/v1 + hugo-content-workspace/v1
- Label-gated to airouter dispatchers (ESO secret required)

Used by cms-proxy /ai/{customer}/draft endpoint.

harnesses/contexts/hugo-content-workspace/v1/init.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+# hugo-content-workspace/v1 init.sh
+# Clones the Hugo content and integration repos for a customer site.
+# Content repo is checked out at HUGO_CONTENT_BRANCH; integration at main.
+set -euo pipefail
+
+echo "=== hugo-content-workspace/v1 init.sh ==="
+
+: "${HUGO_CUSTOMER:?HUGO_CUSTOMER is required (set via runtime.env in task submission)}"
+: "${HUGO_CONTENT_BRANCH:=staging}"
+
+GITEA_HOST="gitea.oreillyit.nz-accelerators"
+ORG="accelerators"
+CONTENT_REPO="hugo-${HUGO_CUSTOMER}-content"
+INTEGRATION_REPO="hugo-${HUGO_CUSTOMER}-integration"
+
+CONTENT_URL="git@${GITEA_HOST}:${ORG}/${CONTENT_REPO}.git"
+INTEGRATION_URL="git@${GITEA_HOST}:${ORG}/${INTEGRATION_REPO}.git"
+
+mkdir -p /workspace/content /workspace/integration /workspace/.agent-output
+
+# Clone content repo at the requested branch
+echo "Cloning content repo: ${CONTENT_URL} (branch: ${HUGO_CONTENT_BRANCH})"
+if git clone --branch "${HUGO_CONTENT_BRANCH}" \
+      -c core.symlinks=false \
+      "${CONTENT_URL}" /workspace/content; then
+    echo "Cloned content repo at branch ${HUGO_CONTENT_BRANCH}"
+else
+    echo "ERROR: Failed to clone content repo ${CONTENT_URL}" >&2
+    exit 1
+fi
+
+# Configure git identity in content repo
+git -C /workspace/content config user.name  "AI Content Assistant"
+git -C /workspace/content config user.email "agent@oreillyit.nz"
+
+# Clone integration repo at main (read context, rarely modified by agent)
+echo "Cloning integration repo: ${INTEGRATION_URL} (branch: main)"
+if git clone --depth 1 --branch main \
+      -c core.symlinks=false \
+      "${INTEGRATION_URL}" /workspace/integration; then
+    echo "Cloned integration repo"
+else
+    echo "WARNING: Could not clone integration repo — non-fatal, proceeding without it" >&2
+fi
+
+# Configure git identity in integration repo if it was cloned
+if [ -d /workspace/integration/.git ]; then
+    git -C /workspace/integration config user.name  "AI Content Assistant"
+    git -C /workspace/integration config user.email "agent@oreillyit.nz"
+fi
+
+# Ensure .gitignore in content repo excludes secrets
+GITIGNORE=/workspace/content/.gitignore
+if [ -f "$GITIGNORE" ]; then
+    if ! grep -q "^\.env$" "$GITIGNORE" 2>/dev/null; then
+        printf '\n# Agent-added safety exclusions\n*.env\n.env\n*.key\n*.pem\n' >> "$GITIGNORE"
+    fi
+fi
+
+export AGENT_WORKING_DIR="/workspace/content"
+echo "AGENT_WORKING_DIR=/workspace/content"
+echo "=== hugo-content-workspace/v1 init.sh complete ==="