fix: task templates use ingress CP_URL (https://agents.oreillyit.nz/api), not svc.cluster.local:8100

The deploy repo NetworkPolicy admits :8100 only from named apps and the traefik/cms-proxy
namespaces; agent/script pods time out, so state-tx / cp-cli calls silently lost transitions.
Invariant now rejects the in-cluster form and pins the ingress URL.

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

task-templates/workflow/bug-ancestor-auto-advance@1.yaml

@@ -33,7 +33,7 @@ nodes:
     cmd: scripts/workflow/parent-link-check
     on_fail: refuse_dispatch
     runtime_env:
-      CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
+      CP_URL: "https://agents.oreillyit.nz/api"
       WORKFLOW_ITEM_UUID: "${item.uuid}"
       PARENT_LINK_TAG: auto-resolve-bugs
       PARENT_LINK_RELATION: parent
@@ -45,7 +45,7 @@ nodes:
     depends_on: [parent-link-check]
     on_fail: escalate
     runtime_env:
-      CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
+      CP_URL: "https://agents.oreillyit.nz/api"
       WORKFLOW_ITEM_UUID: "${item.uuid}"
       TAG_SET_ADD: ai-resolve
   # Advance the bug; R2 then dispatches bug-verify-sonnet@1 at verify-pending.
@@ -55,7 +55,7 @@ nodes:
     depends_on: [tag-ai-resolve]
     on_fail: escalate
     runtime_env:
-      CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
+      CP_URL: "https://agents.oreillyit.nz/api"
       STATE_TX_NEW_STATE: verify-pending
       STATE_TX_FROM_STATES: "pending,open"
 # NOTE (script-node credentials): kind: script nodes are harness-exempt