Isolate agent execution from grading data

[dmorosanu]

Summary

• Stage a sanitized agent task instead of passing the original task YAML into the agent container.
• Keep success criteria, references, lifecycle metadata, and the original task directory on the trusted host.
• Regrade the captured agent workspace after the container exits, using the original private task definition.
• Stop automatically mounting task and reference sources into the agent container.

Why

The agent previously received the complete test case alongside the work it needed to perform. That allowed it to inspect private evaluation inputs such as criteria, solutions, references, and adjacent grading files. This change separates agent execution from grading while preserving the existing artifact-based result flow.

Validation

• Ruff and whitespace checks passed.
• Podman probes confirmed a representative troubleshooting task does not expose task-local grading files, the original task directory, or private evaluation metadata to the agent container.

Follow-up

The stacked public-input branch adds an explicit allowlist for plugin and template inputs, which closes the remaining exposure from raw source mounts.