Add UID/GID isolation for evaluated agents

[dmorosanu]

What changed

• run evaluated Claude, Codex, and Antigravity processes under a dedicated unprivileged Linux UID/GID with cleared capabilities and no_new_privs
• stage agent-visible plugins as manifest-verified public bundles while keeping task, grader, reference, fixture, and output mounts below a root-only parent
• add a protected mock service running as a separate mockd identity behind a group-gated Unix socket
• support exact or finite normalized command maps; normalized matching ignores output formatting and flag order but never uses subset or substring matching
• permit narrowly typed live passthrough such as [docsai, ask], with no shell, bounded execution/output, and in-memory response caching
• scrub harness-only environment paths, bound process counts, reap and verify removal of residual agent processes, and fail closed for unsupported images or privileged dynamic graders
• document the Docker boundary and protected fixture schema

Why

Encryption or runtime sealing does not protect fixtures when the evaluated agent can invoke the decryptor. The boundary must prevent the agent identity from reading grading material and mock fixture bytes while retaining a narrow, observable CLI behavior channel.

Impact and compatibility

Protected Docker isolation is enabled by default. Images must declare org.coder-eval.agent-isolation=uid-gid-v1. docker.working_dir, extra_mounts, and dynamic privileged criteria (run_command, uipath_eval, agent_judge) fail closed until their audiences or grader sandbox are implemented. protected_mocks is opt-in; UiPath/skills#2503 is the dependent migration. Runtime seal is not part of the protected interface.

Native-Linux container validation is still pending because the supplied test VM was unreachable from the implementation environment.

Validation

• repository-wide Ruff passes
• Pyright: 0 errors (one existing Antigravity warning)
• protected-mock/isolation suite: 13 passed and 49 POSIX-only tests skipped on Windows
• broader focused suite: 88 passed and 55 skipped; two unrelated Windows symlink-privilege failures
• earlier broader local run: 4,103 passed; remaining failures were Windows shell/symlink/live-environment cases