feat: adopt Harbor execution foundation

[nmogil]

Summary

• adopt Harbor 0.18.0 as Mogil Bench's pinned coding-eval execution foundation
• run one isolated local-Docker trial with a separate no-network hidden verifier
• retain versioned Mogil-owned evidence bundles with workspace changes, verifier evidence, Harbor locks/results/logs, checksums, and confirmed cleanup
• preserve reviewer-safe BlindBench eval-record v1 export while marking legacy/final-answer-only evidence non_quality
• add a mandatory credential-free real Harbor + Docker CI smoke

Security and evidence boundaries

• Python >=3.12,<3.13, Harbor 0.18.0, and Pi 0.80.6 are exact compatibility pins
• Harbor runs require explicit --allow-agents, Docker only, one attempt, concurrency 1, retries 0, delete=true, and no mounts
• candidate and hidden-verifier build contexts are separate; the verifier runs with no network
• missing/corrupt evidence or unconfirmed cleanup fails closed as insufficient
• Phase 1 cannot emit quality_eligible
• hidden canaries, verifier implementation, absolute paths, and raw Harbor SDK payloads are excluded from default BlindBench v1 output

Verification

Independent fresh Python 3.12 environment:

• pytest -q -m 'not docker_smoke' — 53 passed
• pytest -q -m docker_smoke tests/test_harbor_docker_smoke.py — 1 passed
• ruff check . — passed
• mypy src — passed
• git diff --check — passed
• sample JSON/JSONL artifact validation — passed
• command-adapter regression smoke — passed
• post-smoke Docker inspection — no leaked Harbor/Mogil containers

The real Docker smoke verifies the known workspace patch, separate verifier reward, retained evidence, checksums, canary non-leakage, and exact observed Compose-label cleanup.

Deliberate follow-ups

• Add Pi trajectory capture with ATIF and OTel projections #6: complete Pi event normalization, ATIF, and quality_eligible gating
• Add Daytona as a Harbor sandbox backend #8: Daytona provider support and conformance
• Render full Harbor agent spans and evidence in blind review nmogil/blind-bench#354: full run-level trajectory ingest and human-review rendering
• Fireworks-compatible approved SFT/DPO export remains separately approval-gated

Closes #7