feat: complete benchmark MVP infrastructure

[bjcorder]

Summary

• Add provider runners and suite run harness for echo, OpenAI-compatible, OpenRouter, and Anthropic APIs
• Add public-dev task pack across authz, supply-chain, threat-modeling, and LLM appsec
• Add deterministic task generators with canaries and suite validation commands
• Add fixture semantic judge calibration flow and public calibration fixtures
• Add sealed suite pack/verify/unpack infrastructure with path-safety protections
• Expand documentation for providers, generators, semantic judging, and sealed suites

Validation

• ruff check .
• PYTHONPATH=src pytest -q
• prodsecbench validate-suite tasks/public-dev
• prodsecbench run-suite tasks/public-dev --provider echo --output /tmp/prodsecbench-public-dev-run.json
• prodsecbench calibrate-judge calibration/public/authz-idor-001 --output /tmp/prodsecbench-calibration.json
• prodsecbench seal-suite tasks/public-dev /tmp/prodsecbench-public-dev.psbpack --suite-id public-dev-smoke
• prodsecbench verify-sealed-pack /tmp/prodsecbench-public-dev.psbpack /tmp/prodsecbench-public-dev.manifest.json

Security notes

• Task artifact and prompt paths now reject absolute paths and parent traversal before file reads
• Sealed pack unpacking uses resolved path containment checks and rejects archive links