Add managed benchmark runner image

[c-mongan]

Summary

• add a managed Copilot benchmark sandbox runner base image
• add entrypoint checks for workspace, isolated COPILOT_HOME, and private Copilot CLI install
• add product audit coverage and update eval-hardening docs

Verification

• npm --prefix agentops-cli test
• npm --prefix actioner test
• npm --prefix benchmark-judges/hosted-judge test
• node agentops-cli/src/index.js demo verify --runs 50 --json
• node agentops-cli/src/index.js product audit --json
• bash -n benchmark-runners/copilot-sandbox/docker-entrypoint.sh
• git diff --check

Not verified

• docker build: local Docker/OrbStack socket was unavailable