fix(repo-readonly): own read-only deploy key; workflow-script drops write-capable gitea-ssh/v1

repo-readonly/v1 now declares write_targets: [], an ssh_hosts alias and its
own secrets_required (account platform-readonly.space:platform, a read-only
Gitea deploy key), and stages the key before cloning. workflow-script/v1 no
longer layers gitea-ssh/v1, so script nodes cannot push. Invariants updated:
credential layers in the composite must declare write_targets: [].

Bug 45a48685-23e9-4605-af1f-d93306108cef

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

tests/invariants/test_workflow_script_composite_layers.py

@@ -16,11 +16,12 @@ def _load(kind_dir: str, name: str) -> dict:
     return yaml.safe_load((_ROOT / kind_dir / name / "v1" / "harness.yaml").read_text())
 
 
-def test_workflow_script_layers_shared_variables_then_cp_service_token():
+def test_workflow_script_layers_shared_variables_cp_service_token_repo_readonly():
     doc = _load("composites", "workflow-script")
     assert doc["layers"] == [
         {"context": "shared-variables/v1"},
         {"context": "cp-service-token/v1"},
+        {"context": "repo-readonly/v1"},
     ]