run: scope non-canonical --mode job overlay patches to the eval Job

src/run.rs

@@ -559,6 +559,7 @@ fn run_job(
         format!(
             r#"  - target:
       kind: Job
+      name: {benchmark}-task-{canonical_task}
     patch: |-
       apiVersion: batch/v1
       kind: Job
@@ -590,17 +591,31 @@ images:
       task: "{want_task}"
     includeSelectors: false
 patches:
-  # Rename the Job so multiple tasks can be applied concurrently.
+  # Every patch below targets the canonical Job BY NAME. Some benchmarks
+  # (e.g. tau-bench) ship a bespoke second Job — a user-sim harness — in
+  # the same manifest. An unscoped `kind: Job` target strategic-merges the
+  # runner/gateway container into that Job too, producing an imageless
+  # container that fails admission. Name-scoping confines us to the eval Job.
+  # Override runner env vars.
   - target:
       kind: Job
       name: {benchmark}-task-{canonical_task}
     patch: |-
-      - op: replace
-        path: /metadata/name
-        value: {benchmark}-task-{want_task}
+      apiVersion: batch/v1
+      kind: Job
+      metadata:
+        name: {benchmark}-task-{canonical_task}
+      spec:
+        template:
+          spec:
+            containers:
+              - name: runner
+                env:
+{runner_env_block}
   # Sync pod-template labels so `kubectl get pods -l agent=…` works.
   - target:
       kind: Job
+      name: {benchmark}-task-{canonical_task}
     patch: |-
       apiVersion: batch/v1
       kind: Job
@@ -612,22 +627,16 @@ patches:
             labels:
               agent: {want_agent}
               task: "{want_task}"
-  # Override runner env vars.
+{gateway_patch}  # Rename the Job LAST — the name-scoped patches above must match the
+  # canonical name before the rename changes it. Lets concurrent tasks coexist.
   - target:
       kind: Job
+      name: {benchmark}-task-{canonical_task}
     patch: |-
-      apiVersion: batch/v1
-      kind: Job
-      metadata:
-        name: {benchmark}-task-{canonical_task}
-      spec:
-        template:
-          spec:
-            containers:
-              - name: runner
-                env:
-{runner_env_block}
-{gateway_patch}"#,
+      - op: replace
+        path: /metadata/name
+        value: {benchmark}-task-{want_task}
+"#,
         rel_base = rel_base.display(),
     );
     let kustomization_path = tmp_dir.join("kustomization.yaml");