fix(harnesses): stage tokens for agent UID, fix three broken auth paths

Mirrors agent-runtimes audit + fix. All three M22 Phase 9 wrapper-script
auth paths were broken since the cutover: each one ran as the agent UID
trying to `cat` a 0400 root-only ESO mount. Same root cause we hit on
minimax/z-ai earlier today.

Changes:

1. anthropic-cloud-paul-oauth/v1 (NEW in framework)
   - Mirrors agent-runtimes — was previously only present there.
   - init.sh stages oauth_token into ~/.claude/.credentials.json (Claude
     Code's native subscription-OAuth schema). No env, no apiKeyHelper,
     no wrapper. Restores the equivalent of what harness_init.py used to
     do for the legacy SOPS path.
   - The legacy `bin/anthropic-wrapper.sh` was dead code (never wired).

2. gitea-https/v1
   - init.sh stages the token to $HOME/.config/git/gitea-https-token
     (0600 agent:agent) and points the per-host git credential helper at
     the staged copy. Previously the helper `cat`d the ESO mount path
     and silently failed at every git invocation.

3. gitea-admin/v1
   - init.sh stages the token to $HOME/.config/gitea-admin/token
     (0600 agent:agent). Wrapper updated to read from the staged copy.
   - Removes stale `requires: anthropic-cloud/v1` (the only anthropic
     harness in agent-runtimes is anthropic-cloud-paul-oauth/v1).

Pattern matches gitea-ssh / minimax / z-ai: ESO mount stays root-only,
init.sh runs as root and `install -m 0600 -o agent -g agent`s a single
explicit copy. Per-secret enumeration; future ESO Secret keys remain
inaccessible by default.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

harnesses/contexts/anthropic-cloud-paul-oauth/v1/harness.yaml

@@ -0,0 +1,18 @@
+kind: context
+name: anthropic-cloud-paul-oauth
+version: 1
+description: "Anthropic cloud — subscription OAuth token for paul (personal account)"
+requires: []
+provides: [claude-code]
+
+env:
+  ENFORCE_SUBSCRIPTION_PRICING: "true"
+
+scripts:
+  init: "./init.sh"
+
+secrets_required:
+  - name: anthropic-cloud-paul-oauth
+    account_ref: "anthropic-cloud-paul-oauth.user:paul"
+    mount_path: /run/agent/secrets/anthropic-cloud-paul-oauth
+    mode: "0400"