fix(repo-readonly): own read-only deploy key; workflow-script drops write-capable gitea-ssh/v1

repo-readonly/v1 now declares write_targets: [], an ssh_hosts alias and its
own secrets_required (account platform-readonly.space:platform, a read-only
Gitea deploy key), and stages the key before cloning. workflow-script/v1 no
longer layers gitea-ssh/v1, so script nodes cannot push. Invariants updated:
credential layers in the composite must declare write_targets: [].

Bug 45a48685-23e9-4605-af1f-d93306108cef

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

harnesses/composites/workflow-script/v1/harness.yaml

@@ -32,5 +32,4 @@ layers:
   # is a no-op there too. Layered-in instead of layering agent-repo/v1
   # because that context's fork management and push side effects are wrong
   # for a read-only script node (see bug item body).
-  - context: gitea-ssh/v1
   - context: repo-readonly/v1