once.toml is now workspace-only; scripts use # once headers

TOML-backed script targets have been removed. once.toml is now reserved for workspace configuration such as cache providers. Scripts declare their inputs, outputs, environment, remote provider, and working directory with # once headers inside the script file.