fix(ci): port #1169 npm cache fix and run the harness from a snapshot

.github/workflows/aeon.yml

@@ -240,15 +240,14 @@ jobs:
         if: steps.work.outputs.mode != ''
         # ~/.npm is npm's content-addressable download cache — reusing it lets the
         # pinned install run fully offline. Version is baked into the key (immutable,
-        # ~100% hit after the first run of a version, shared with messages.yml). The
-        # restore-keys prefix degrades gracefully on a version bump. Keep the version
-        # in the key in sync with the pin below.
+        # ~100% hit after the first run of a version, shared with messages.yml). Keep
+        # the version in the key in sync with the pin below. No restore-keys: an older
+        # cache carries a stale packument, and --prefer-offline trusts it, so a bumped
+        # pin fails with ETARGET forever (the failed install never saves a new key).
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.npm
           key: claude-code-${{ runner.os }}-2.1.287
-          restore-keys: |
-            claude-code-${{ runner.os }}-
 
       - name: Install Claude Code
         if: steps.work.outputs.mode != ''
@@ -1104,7 +1103,7 @@ jobs:
           # request). The post-run guard reverted it after the fact; now the write is
           # refused outright.
           CLAUDE_OK=0
-          RH="${GITHUB_WORKSPACE}/harness-adapter/run-harness"
+          RH=$(bash scripts/harness-adapter-snapshot.sh)
           RH_ARGS=(--mode "$SKILL_MODE" --allowed-tools "$ALLOWED" --timeout 1800)
           # Tier notes (skill_mode.sh run-notes): notify via stdin, no shell file writes.
           RUN_NOTES=$(bash scripts/skill_mode.sh run-notes "$SKILL_MODE")

.github/workflows/messages.yml

@@ -405,13 +405,12 @@ jobs:
       - name: Cache Claude Code (npm)
         if: steps.msg.outputs.source != ''
         # Shares the pinned-version cache with aeon.yml so the global install runs
-        # offline. Keep the version in the key in sync with the pin below.
+        # offline. Keep the version in the key in sync with the pin below. No
+        # restore-keys (see aeon.yml: a stale packument breaks a bumped pin).
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.npm
           key: claude-code-${{ runner.os }}-2.1.287
-          restore-keys: |
-            claude-code-${{ runner.os }}-
 
       - name: Install Claude Code
         if: steps.msg.outputs.source != ''

scripts/harness-adapter-snapshot.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# harness-adapter-snapshot.sh - copy harness-adapter/ out of the workspace and
+# print the path of the copy's run-harness.
+#
+#   usage: RH=$(bash scripts/harness-adapter-snapshot.sh)   (before the skill runs)
+#
+# Why: bash reads a script as it executes it. A skill that rewrites
+# harness-adapter/ while it runs (aeon-update syncing upstream into the
+# workspace) leaves the running run-harness and adapter reading a file that
+# changed under them: "unexpected EOF" once the agent exits, the attempt counts
+# as a provider failure, and the gateway cascade re-runs the whole skill
+# (aeon-agent run 37300267512). Running from a copy keeps the run on the
+# harness it started with; the synced files land in the workspace as before.
+#
+# The copy lives under $HOME, not $RUNNER_TEMP or /tmp: those are writable
+# inside the read-only sandbox (lib/sandbox.sh), and the unsandboxed scorer
+# runs this same copy later. $HOME itself stays read-only there. Nothing in
+# harness-adapter/ refers to paths outside its own folder, so the copy behaves
+# the same.
+set -euo pipefail
+
+src="${GITHUB_WORKSPACE:-$(pwd)}/harness-adapter"
+dst="${HOME}/.aeon-run/harness-adapter"
+
+[ -f "$src/run-harness" ] || { echo "harness-adapter-snapshot: $src/run-harness missing" >&2; exit 1; }
+rm -rf "$dst"
+mkdir -p "$dst"
+cp -a "$src/." "$dst/"
+echo "$dst/run-harness"