feat(eval): support configurable container runtime

[Sayt-0]

Summary

• add an eval-only --container-runtime flag, defaulting to docker
• use the selected Docker-compatible CLI for both image builds and container runs
• record the selected runtime in logs and evaluation JSON output
• update evaluation documentation with a Podman example

Issue expectations

Expectation	Implementation
Run evaluations without requiring the Docker CLI	--container-runtime accepts an alternative Docker-compatible executable or path
Support Podman as the motivating runtime	documented with docker agent eval agent.yaml --container-runtime podman
Preserve existing behavior	Docker remains the default and the fallback for programmatic callers
Keep evaluation isolation	evaluations continue to build and run in containers with the existing flags and cancellation behavior

Validation

• go test ./...
• go test ./cmd/root ./pkg/evaluation
• ./scripts/build.sh
• golangci-lint run
• go run ./lint .
• go mod tidy --diff

A real Podman daemon was not available locally. Build and run selection are covered with fake-executable tests against the Docker-compatible CLI contract.

Closes #3887