feat(evals): add capped live evaluation runner

[ernestprovo23]

Summary

• add a sequential, checkpointed paid-exploratory runner for all six frozen evaluation conditions
• enforce an exact USD 10.00 ceiling with pessimistic reservations, authenticated checkpoints, one-process leasing, and bounded receipts
• add a network-free worst-case estimator, guarded CLI execution, and sanitized deterministic replay fixtures
• reserve native structured-output contracts, bound verdict-repair amplification, and reconcile all provider-reported token usage

Linear: DSE-708

Verification

• 715 passed
• ruff check .
• ruff format --check .
• git diff main...HEAD --check
• gitleaks detect --no-banner --redact --source .
• two read-only adversarial review passes; final verdict clean

No paid provider call was made before this PR. The live smoke remains a separate, explicitly capped correctness gate.