fix(repo-readonly): own read-only deploy key; workflow-script drops write-capable gitea-ssh/v1

repo-readonly/v1 now declares write_targets: [], an ssh_hosts alias and its
own secrets_required (account platform-readonly.space:platform, a read-only
Gitea deploy key), and stages the key before cloning. workflow-script/v1 no
longer layers gitea-ssh/v1, so script nodes cannot push. Invariants updated:
credential layers in the composite must declare write_targets: [].

Bug 45a48685-23e9-4605-af1f-d93306108cef

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

harnesses/contexts/repo-readonly/v1/init.sh

@@ -52,6 +52,18 @@ if [ -d /workspace/project ] && [ -n "$(ls -A /workspace/project 2>/dev/null)" ]
     exit 0
 fi
 
+# Stage the ESO-mounted read-only deploy key where the harness-init
+# ~/.ssh/config IdentityFile expects it (same destination gitea-ssh/v1 used;
+# that layer is no longer part of workflow-script/v1 — bug 45a48685).
+SSH_KEY_SRC="/run/agent/secrets/gitea-ssh-readonly/private_key"
+SSH_KEY_DST="/home/agent/.ssh/gitea-oreillyit-nz-ai-enablement"
+if [ ! -r "$SSH_KEY_SRC" ]; then
+    echo "ERROR: read-only SSH key not found at $SSH_KEY_SRC — ESO ExternalSecret not Ready?" >&2
+    exit 1
+fi
+mkdir -p /home/agent/.ssh
+install -m 0600 -o agent -g agent "$SSH_KEY_SRC" "$SSH_KEY_DST"
+
 mkdir -p /workspace
 
 echo "Cloning (read-only): $AGENT_REPO_URL -> /workspace/project"