fix(eval): guard writes and bound case concurrency

[LukasParke]

What

• refuse optimizer write-back unless every target is tracked and clean in Git
• add --force-dirty for deliberate dirty/untracked overrides while still requiring a repository
• run the guard before coding-agent apply and skip stale literal locations in files the agent rewrites
• run eval cases through an order-preserving bounded pool (default 4, configurable with --concurrency)
• remove the accepted-but-ignored --budget/budget option

Why

Optimization write-back replaces source literals. Without a version-control guard it can destroy uncommitted work, including changes made by a structural coding-agent pass. Eval suites also ran cases serially even though each case owns an independent context.

The removed budget option had no downstream reader and therefore provided false safety. maxMetricCalls remains the actual GEPA evaluation bound.

This semantically ports only the eval safety/concurrency portion of fork/port/openrouter-fixes commit aedf712f. GEPA discovery, traversal, and judge reuse remain item 5 and are not included here.

Test plan

• eval suite — 2,066 pass, 6 integration/benchmark skips in the root test command
• focused write-guard/optimizer/concurrency tests — 29 pass
• eval typecheck
• root lint
• sentrux check .
• sentrux gate .
• clean-context Pi review; fixed absolute/worktree path handling, no-repo override, API validation, and docs

Breaking behavior

• --budget and the corresponding programmatic budget option are removed because they were silently ignored.
• eval cases now run with concurrency 4 by default; use --concurrency 1 for suites sharing external mutable state.

[vercel]

@LukasParke is attempting to deploy a commit to the Matt Apperson's projects Team on Vercel.

A member of the Team first needs to authorize it.

[LukasParke]

Agent: CI reached the full core suite and failed only the unrelated timing-sensitive executeRunCode retry backoff test (fixed backoff or linear backoff depending on the run). The affected package tests/typechecks and local full suite passed. The separate compat failure is the repository workflow receiving an empty OPENROUTER_API_KEY, and Vercel requires upstream authorization. I cannot rerun upstream Actions without repository admin rights.