feat(evals): package a portable Runner controller runtime (#17506)

Package a verified portable Runner eval controller with complete bounded file receipts, copied dependency closure, private evidence replay and symlink-safe CLI entrypoints. Preserve fail-closed cost holds, native trace receipts and all parent security repairs.

Verified head: 1c892ff464.
Validation: 72 synthetic source/portable tests pass after current-master sync. Full current-head CI passed (40386180906); Greptile reviewed this exact head at5/5, with zero unresolved findings.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/__tests__/issue-list-assignee-filter-routes.test.ts

@@ -883,6 +883,7 @@ describeEmbeddedPostgres("issue list routes assigneeAgentId filter", () => {
     "descendantOf",
     "labelId",
     "participantAgentId",
+    "createdFromIssueId",
   ])("returns 422 instead of a DB error for malformed %s filters", async (param) => {
     const companyId = randomUUID();
     await db.insert(companies).values({
@@ -911,6 +912,7 @@ describeEmbeddedPostgres("issue list routes assigneeAgentId filter", () => {
     "descendantOf",
     "labelId",
     "participantAgentId",
+    "createdFromIssueId",
   ])("returns 422 from issues/count for malformed %s filters", async (param) => {
     const companyId = randomUUID();
     await db.insert(companies).values({