feat: add verify script runner for post-agent outcome verification

[melmennaoui]

Summary

Add a verify script runner to the evaluation package that executes a shell script via docker exec on the eval container after the agent completes. This enables filesystem-level and side-effect checks that cannot be expressed as text assertions on the response (e.g. "did the agent actually create the file?").

Changes

pkg/evaluation/verify.go (new)

• runVerifyScript() — executes a shell script on a running container:
  • Zero exit code → pass; non-zero → fail
  • 60-second timeout prevents runaway scripts
  • stdout + stderr captured and merged
  • Output capped at 8 KB to bound memory
  • Empty script is a no-op pass (verify is optional)
• verifyResult struct — Passed, ExitCode, Output
• maxVerifyOutputBytes constant (8192)

pkg/evaluation/verify_test.go (new)

• Empty script passes without running anything
• Zero exit code passes and captures output
• Non-zero exit code fails and captures output
• Large output is capped at the limit
• writeFakeExecRuntime test helper avoids needing a real Docker daemon

Usage (wired by #4086)

The eval JSON declares a verify script in the evals block:

{
  "evals": {
    "verify": "test -f /workspace/hello.txt && grep -q 'Hello' /workspace/hello.txt"
  }
}

After the agent run, the framework runs docker exec <container> sh -c '<script>' and records the result.

Closes #4083