feat: migrate missing harnesses, templates, and workflows from agent-runtimes

Brings the framework CRS repo up to date with all content that was
living in agent-runtimes (local-dev fallback) but hadn't been promoted.

New composites: feature-delivery-loop, integration-direct, scaffolding-repo,
sonnet-impl-narrow, sonnet-manager, test-writing-repo

New contexts: integration/v1, scaffolding/v1, sonnet-manager/v1, z-ai/v1,
airouter/v1/bin (anthropic-compat-wrapper.sh), cp-harness/v1/init.sh

New task-templates: sonnet-integrator.yaml, workflow/* (17 typed workflow
task templates for the Epic 1 pipeline)

Updated: agent-repo/v1/finalize.sh — adds AR-38/F97 empty-deliverable audit
(SKIP_BRANCH_PUSH support, boilerplate-path filtering, ci_metadata.json flag)

Also adds MEMORY.md index and memory/ topic files for the framework repo.

harnesses/contexts/z-ai/v1/harness.yaml

@@ -0,0 +1,29 @@
+kind: context
+name: z-ai
+version: 1
+description: "Z.ai — Anthropic-API-compatible endpoint"
+requires: []
+provides: [claude-code]
+
+# Auth is wired by init.sh via Claude Code's apiKeyHelper (settings.json).
+# No credential env vars: the secret stays in the mounted file and is read
+# only by the helper command at request time.
+env:
+  ANTHROPIC_BASE_URL: "https://api.z.ai/v1"
+  CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS: "1"
+  CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
+  DISABLE_PROMPT_CACHING: "1"
+
+secrets_required:
+  - name: z-ai
+    account_ref: "z-ai"
+    mount_path: /run/agent/secrets/z-ai
+    # 0400 (root-only) — defense in depth. The agent user CANNOT read this
+    # mount. init.sh runs as root and `install`s a per-secret copy into the
+    # agent's home with mode 0600 owned by agent; only that copy is exposed
+    # to the runtime. Matches the gitea-ssh pattern. If the ESO Secret
+    # later grows additional keys, they remain inaccessible by default.
+    mode: "0400"
+
+scripts:
+  init: ./init.sh