fix(harnesses): stage tokens for agent UID, fix three broken auth paths

Mirrors agent-runtimes audit + fix. All three M22 Phase 9 wrapper-script
auth paths were broken since the cutover: each one ran as the agent UID
trying to `cat` a 0400 root-only ESO mount. Same root cause we hit on
minimax/z-ai earlier today.

Changes:

1. anthropic-cloud-paul-oauth/v1 (NEW in framework)
   - Mirrors agent-runtimes — was previously only present there.
   - init.sh stages oauth_token into ~/.claude/.credentials.json (Claude
     Code's native subscription-OAuth schema). No env, no apiKeyHelper,
     no wrapper. Restores the equivalent of what harness_init.py used to
     do for the legacy SOPS path.
   - The legacy `bin/anthropic-wrapper.sh` was dead code (never wired).

2. gitea-https/v1
   - init.sh stages the token to $HOME/.config/git/gitea-https-token
     (0600 agent:agent) and points the per-host git credential helper at
     the staged copy. Previously the helper `cat`d the ESO mount path
     and silently failed at every git invocation.

3. gitea-admin/v1
   - init.sh stages the token to $HOME/.config/gitea-admin/token
     (0600 agent:agent). Wrapper updated to read from the staged copy.
   - Removes stale `requires: anthropic-cloud/v1` (the only anthropic
     harness in agent-runtimes is anthropic-cloud-paul-oauth/v1).

Pattern matches gitea-ssh / minimax / z-ai: ESO mount stays root-only,
init.sh runs as root and `install -m 0600 -o agent -g agent`s a single
explicit copy. Per-secret enumeration; future ESO Secret keys remain
inaccessible by default.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

harnesses/contexts/gitea-admin/v1/harness.yaml

@@ -2,8 +2,7 @@ kind: context
 name: gitea-admin
 version: 1
 description: "Gitea admin: SSH, git identity, API token for skynet org"
-requires:
-  - anthropic-cloud/v1
+requires: []
 provides: [gitea-admin]
 
 git_identity: