fix(eval): unblock Harbor startup with current policy and task user

[Astro-Han]

Summary

Harbor evaluation startup failed before model execution when the generated runtime policy was decoded as v2, when a task image used a non-root user, or when a connection relied on provider-default thinking.

Write the current v4 policy document, prepare relay logs and private environment files for the task's existing UID/GID, and allow thinkingLevel to be omitted. Explicit invalid thinking levels are rejected during configuration validation. The subject still runs as the task user; only directory and file ownership preparation uses root. Existing configurations with valid explicit thinking levels remain supported.

Verification

• Built @maka/eval and ran lifecycle-boundaries.test: 19 passed. Restoring the old policy version and mandatory thinking field independently makes the corresponding regression fail.
• Python relay suite: 44 passed, 2 skipped.
• npm run format and npm run lint passed.
• Actual Runta Docker image with USER agent (UID 10001) reached Host admission after the relay fix; before it, /logs/artifacts was not writable.
• Live Runta + GOAT probe passed (reward 1, completed): Bash returned UID 10001, Write created a file, Read returned READY, and the Host captured 19 runtime events and 4 model calls. Runta build CA injection is an experiment environment adaptation and is not included in product code.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex investigated the startup failures, implemented these fixes, and ran regression and container checks.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No