feat(run): add --mode crane — materialize evals at run time

[elronbandel]

What

A new, additive deployment mode. Where --mode container runs the pre-built evals/<benchmark>--<agent> combination image, --mode crane runs ONE generic core/crane-runner image that materializes the eval at run time: it crane exports the per-axis benchmarks/<b> + agents/<a> (+ models/<gateway>) images into a rootfs and fuses them in-container with bwrap/chroot — no Docker daemon, no DinD.

So the per-(benchmark, agent) combination matrix becomes an optional pre-bake, and per-task benchmarks (SWE-bench) run from one image — the runner pulls the per-task rootfs, so a single image fans out across tasks (which a per-task combination image cannot). It is the single-container analog of the generic compose artifact — one better: it composes the axes at run time rather than pulling a pre-fused product.

Additive — nothing existing changes

compose/container/job untouched; the combination matrix still builds and works (this just makes it optional); opt in with --mode crane; unused → zero impact.

Changes

• cli: Mode::Crane + run_crane (mirrors run_container; passes EVAL_BENCHMARK_ENV=per-task via is_per_task_by_name) + naming::crane_runner_image (+ unit test).
• containers/core/crane-runner: the runner image (Dockerfile + materialize) and a daemonless proof (crane-poc.sh).

Verified

• cargo build + naming test green; dry-runs correct (shared-env; per-task adds EVAL_BENCHMARK_ENV=per-task; --agent/--local guards).
• Daemonless mechanism (crane-poc.sh): crane pulls a rootfs + chroot/bwrap runs in it + agent edits the testbed — no daemon.
• Real-image fusion: the real swe-bench /testbed (sympy repo) ⊎ real claude-code /opt/agent reproduce the combination layout (922 MB, byte-level).
• Isolation survives the fusion (the key safety check): export preserves root-only modes/owners (/tasks 0600, /tests & /opt/gateway 0700, root) — so the existing gosu agent / env -i pipeline keeps answers unreadable. The invariant is reused, not reinvented.

🚧 Draft — definition of done (statically verified)

First cut proves the fusion. To fully replace container mode for every benchmark / every user / all the time:

A. Functional (run at all)

• Pull the 3rd axis (models/<gateway> → /opt/gateway)
• Run the agent's install.sh (symlinks; light)
• Bake otelcol + process-compose + gosu + /usr/local/bin/{run,write-result} into the runner; extract as root, then exec /entrypoint.sh /usr/local/bin/run
• Emit /output/task/result.json (via baked write-result)

B. Correctness (or scores are silently invalid)

• Isolation: extract as root + run agent via gosu agent/env -i (export preserves perms — verified ✓)
• Arch match: runner + node + pulled rootfs (swe-bench is x86_64; runner built here is arm64)
• Digest-pin pulls; record digests in the result

C. Distribution (every end user)

• Per-axis images published & pullable · [ ] registry auth · [ ] insecure/mirror support

D. Operational (all the time)

• Ephemeral-disk sizing for the GB rootfs · [ ] bwrap→chroot fallback soundness · [ ] caching/mirror for big pulls · [ ] cleanup + pull retries

E. Acceptance bar

• Conformance: crane(X) == container(X) (same result.json) across shared-env + per-task, in CI
• Bake target + publish core/crane-runner

F. Governance

• Doctrine rule: when crane applies, digest-pin, isolation invariant

The hard conceptual risk (daemonless fusion of real images) is done. What remains is mostly A (wire the existing orchestrator) + E (conformance in CI), gated by B (isolation — verified preservable via reuse). Arch (B7) is the one hard external constraint.