fix(repo-readonly): own read-only deploy key; workflow-script drops write-capable gitea-ssh/v1

repo-readonly/v1 now declares write_targets: [], an ssh_hosts alias and its
own secrets_required (account platform-readonly.space:platform, a read-only
Gitea deploy key), and stages the key before cloning. workflow-script/v1 no
longer layers gitea-ssh/v1, so script nodes cannot push. Invariants updated:
credential layers in the composite must declare write_targets: [].

Bug 45a48685-23e9-4605-af1f-d93306108cef

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

harnesses/composites/workflow-script/v1/harness.yaml

@@ -32,5 +32,4 @@ layers:
   # is a no-op there too. Layered-in instead of layering agent-repo/v1
   # because that context's fork management and push side effects are wrong
   # for a read-only script node (see bug item body).
-  - context: gitea-ssh/v1
   - context: repo-readonly/v1

harnesses/contexts/repo-readonly/v1/harness.yaml

@@ -5,6 +5,11 @@ description: "Read-only project-repo clone for harness-path kind: script nodes (
 requires: []
 provides: []
 
+# HC-11: read-only layer. No push target; the credential below is a read-only
+# deploy key (Gitea key id 20 on skynet/agent-runtimes), so a script node
+# cannot write even if its code tries (bug 45a48685).
+write_targets: []
+
 # WF-COMP-34: this layer's init.sh is the read-only clone. It only runs
 # when AGENT_REPO_URL is set; the unset case is a no-op (a script node
 # whose template omits agent_repo keeps its pre-fix silent empty workspace
@@ -21,4 +26,14 @@ env:
 scripts:
   init: "./init.sh"
 
-secrets_required: []
+ssh_hosts:
+  - alias: gitea.oreillyit.nz-ai-enablement
+    hostname: gitea.oreillyit.nz
+    user: git
+    identity_secret: GITEA_SSH_KEY
+
+secrets_required:
+  - name: gitea-ssh-readonly
+    account_ref: "platform-readonly.space:platform"
+    mount_path: /run/agent/secrets/gitea-ssh-readonly
+    mode: "0400"

harnesses/contexts/repo-readonly/v1/init.sh

@@ -52,6 +52,18 @@ if [ -d /workspace/project ] && [ -n "$(ls -A /workspace/project 2>/dev/null)" ]
     exit 0
 fi
 
+# Stage the ESO-mounted read-only deploy key where the harness-init
+# ~/.ssh/config IdentityFile expects it (same destination gitea-ssh/v1 used;
+# that layer is no longer part of workflow-script/v1 — bug 45a48685).
+SSH_KEY_SRC="/run/agent/secrets/gitea-ssh-readonly/private_key"
+SSH_KEY_DST="/home/agent/.ssh/gitea-oreillyit-nz-ai-enablement"
+if [ ! -r "$SSH_KEY_SRC" ]; then
+    echo "ERROR: read-only SSH key not found at $SSH_KEY_SRC — ESO ExternalSecret not Ready?" >&2
+    exit 1
+fi
+mkdir -p /home/agent/.ssh
+install -m 0600 -o agent -g agent "$SSH_KEY_SRC" "$SSH_KEY_DST"
+
 mkdir -p /workspace
 
 echo "Cloning (read-only): $AGENT_REPO_URL -> /workspace/project"