fix(harnesses): stage tokens for agent UID, fix three broken auth paths

Mirrors agent-runtimes audit + fix. All three M22 Phase 9 wrapper-script
auth paths were broken since the cutover: each one ran as the agent UID
trying to `cat` a 0400 root-only ESO mount. Same root cause we hit on
minimax/z-ai earlier today.

Changes:

1. anthropic-cloud-paul-oauth/v1 (NEW in framework)
   - Mirrors agent-runtimes — was previously only present there.
   - init.sh stages oauth_token into ~/.claude/.credentials.json (Claude
     Code's native subscription-OAuth schema). No env, no apiKeyHelper,
     no wrapper. Restores the equivalent of what harness_init.py used to
     do for the legacy SOPS path.
   - The legacy `bin/anthropic-wrapper.sh` was dead code (never wired).

2. gitea-https/v1
   - init.sh stages the token to $HOME/.config/git/gitea-https-token
     (0600 agent:agent) and points the per-host git credential helper at
     the staged copy. Previously the helper `cat`d the ESO mount path
     and silently failed at every git invocation.

3. gitea-admin/v1
   - init.sh stages the token to $HOME/.config/gitea-admin/token
     (0600 agent:agent). Wrapper updated to read from the staged copy.
   - Removes stale `requires: anthropic-cloud/v1` (the only anthropic
     harness in agent-runtimes is anthropic-cloud-paul-oauth/v1).

Pattern matches gitea-ssh / minimax / z-ai: ESO mount stays root-only,
init.sh runs as root and `install -m 0600 -o agent -g agent`s a single
explicit copy. Per-secret enumeration; future ESO Secret keys remain
inaccessible by default.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

harnesses/contexts/gitea-admin/v1/bin/gitea-admin-wrapper.sh

@@ -1,22 +1,25 @@
 #!/bin/bash
-# gitea-admin-wrapper.sh — reads the ESO-mounted gitea-admin token at exec time
-# and prefixes it as a transient env var to the underlying tool.
+# gitea-admin-wrapper.sh — reads the agent-staged gitea-admin token at exec
+# time and prefixes it as a transient env var to the underlying tool.
 #
-# M22 Phase 9: token mounted at /run/agent/secrets/gitea-admin/token (read-only,
-# tmpfs, mode 0400). The token NEVER enters the wrapper's parent shell — only
-# the exec'd tool's environment via `exec env VAR=value cmd`. The brief
-# presence in /proc/<tool_pid>/environ of the tool process is the accepted
-# floor (per spec/secrets-runtime.md SR-DISP-7 / H-SECRET-4).
+# M22 Phase 9 staging pattern: init.sh runs as root and `install`s a 0600
+# agent-owned copy of the ESO-mounted token into $HOME/.config/gitea-admin/
+# token. This wrapper reads the staged copy, not the ESO mount path, so
+# the `cat` succeeds under the agent UID. The brief presence of the token
+# in /proc/<tool_pid>/environ of the exec'd tool is the accepted floor
+# (per H-SECRET-4 / SR-DISP-7); the wrapper's parent shell never sees it.
+
 set -euo pipefail
 
-TOKEN_FILE="/run/agent/secrets/gitea-admin/token"
+TOKEN_FILE="$HOME/.config/gitea-admin/token"
 
 # git-credential-helper subcommand: read token and emit git credential format.
 # Git invokes us as `gitea-admin-wrapper.sh git-credential-helper get` and
 # expects key=value lines on stdout terminated by a blank line.
 git_credential_helper() {
     if [[ ! -r "$TOKEN_FILE" ]]; then
-        echo "gitea-admin-wrapper: token file not readable at $TOKEN_FILE" >&2
+        echo "gitea-admin-wrapper: staged token not readable at $TOKEN_FILE" >&2
+        echo "gitea-admin-wrapper: did init.sh run? (it stages the token from the ESO mount)" >&2
         exit 1
     fi
     local base_url="${GITEA_BASE_URL:-https://gitea.oreillyit.nz}"
@@ -33,7 +36,8 @@ case "${1:-}" in
         ;;
     *)
         if [[ ! -r "$TOKEN_FILE" ]]; then
-            echo "gitea-admin-wrapper: token file not readable at $TOKEN_FILE" >&2
+            echo "gitea-admin-wrapper: staged token not readable at $TOKEN_FILE" >&2
+            echo "gitea-admin-wrapper: did init.sh run? (it stages the token from the ESO mount)" >&2
             exit 1
         fi
         # `exec env VAR=...` keeps the secret out of the wrapper's parent shell