feat(core): add an isolated evidence-only review harness

[chent1996]

Summary

Add an optional evidence_review Agent type for analyzing supplied evidence without tools or ambient workspace resources. The context compiler and Agent factory enforce an empty tool set, fixed evidence-only instructions, and exclusion of MCP, memory, knowledge, skills, extensions, and workspace prompt files.

Current SiForge delivery reviews reuse the existing project Coding Agent; this optional harness is not the active delivery-review path. Companion SiCore provisioning validates the dedicated type before use. Existing Coding Agent source access remains unchanged.

Test Plan

• Full test suite: 7083 passed, 2 skipped.
• Runtime build and targeted compiler/factory/resource-loader/AgentBox tests passed.
• Deployed Runtime/AgentBox regression: ordinary Coding Agent conversation and actual versioned source reads worked; release re-review and Workflow pass/fail gates completed.
• Dedicated evidence-only model-envelope isolation verified in every deployment mode. Automated tests exercise resource exclusion; the latest live regression uses Coding Agent.
• AgentBox code search: ripgrep is missing; the proposed image dependency change is not included.

Architecture Checklist

• Deployment mode: full live dedicated-type verification in both LocalSpawner and K8sSpawner remains open.
• Security model: no new shell execution path; the evidence-only type exposes no tools.
• DB parity and new-tool registration: not applicable; this change adds neither a Portal database migration nor a tool.

General Checklist

• Changes focus on the optional evidence-only harness.
• Commit uses Conventional Commits.
• No production dependency was added.

Related changes

• siforge: http://gitlab.scitix-inner.ai/siforge/siforge/-/merge_requests/99
• devops: http://gitlab.scitix-inner.ai/k8s/scitix-devops/-/merge_requests/407
• sicore: http://gitlab.scitix-inner.ai/k8s/sicore/-/merge_requests/1199