feat(evaluator-sdk): native Harbor runtime with one-call run_harbor_eval

[arpitsardhana]

Summary

Makes the NeMo Evaluator SDK run Harbor tasks natively from a declarative config, so callers no longer re-implement the Harbor plumbing (JobConfig build, Job.create/job.run, task discovery, and custom-agent import scoping). Targets NemoOptimizeIntegration (stacks on top of the experimental Harbor runtime in #544).

This PR delivers Phase 1 and Phase 2 of the deep-integration plan as two atomic commits. Scope is SDK-only — NeMo Optimizer is untouched.

• Phase 1 — config-driven native runtime for built-in, name-based Harbor agents.
• Phase 2 — custom import_path wrapped-agent support (a user harbor_wrapper.py), with the sys.modules scoping owned by the SDK.

Minimal client-side plumbing is the acceptance criterion for both.

Caller side is two lines (apart from imports)

from nemo_evaluator_sdk.agent_eval.runtimes.harbor_runtime import (
    HarborRuntimeConfig, run_harbor_eval,
)

# built-in agent
config = HarborRuntimeConfig(jobs_dir=jobs_dir, agent_name="oracle")
result = await run_harbor_eval(config, "hello_world_dataset")  # loads tasks, runs, scores

# custom wrapped agent (Phase 2)
config = HarborRuntimeConfig(
    jobs_dir=jobs_dir,
    agent_dir="path/to/agent",              # dir holding harbor_wrapper.py
    agent_import_path="harbor_wrapper:WrappedAgent",
)
result = await run_harbor_eval(config, "hello_world_dataset")

Phase 1 — config-driven native runtime

• HarborRuntimeConfig — declarative config (agent, attempts, concurrency, timeouts, artifacts) with plain/pydantic fields only, mapped onto Harbor's JobConfig lazily.
• HarborAgentTaskRunner — new native mode builds and runs the job itself; the existing injected/offline job_dir mode is preserved (back-compatible).
• HarborTasksetLoader / discover_harbor_tasks — "dataset dir → tasks" in one call (implements AgentEvalTasksetLoader).
• run_harbor_eval(config, dataset_path) — one-call entry point: load tasks, run, score with HarborRewardMetric.
• Example shrunk to the two-line native/optimizer path; README refreshed.

Phase 2 — custom import_path agents in the SDK

• scoped_harbor_agent_import(agent_dir, import_path) — context manager that injects the user's agent package into sys.modules under a uniquely-named synthetic root for the duration of the run and tears it down after. Harbor resolves custom agents with a plain importlib.import_module (no sys.path handling of its own), so this fills the gap for directory-shape wrappers while leaving Harbor's mechanism intact.
• Lock-guarded + collision-free — the sys.modules mutation is guarded by a process-wide lock, and each run gets its own package name, so concurrent runs don't corrupt each other's import state. Callers never touch global import state.
• HarborRuntimeConfig.agent_dir added; _build_native_job resolves the job dir up front and builds/runs the JobConfig inside run_job so wrapped agents get the scoped import path.

Design notes

• harbor is imported lazily inside run_tasks (never at module load), matching FabricAgentRuntime. Importing the SDK never requires Harbor.
• Harbor is intentionally not added to the locked deps: it requires Python >=3.12 while the workspace supports >=3.11, which makes the lock unsatisfiable (same reason nemo_fabric isn't locked). Install separately: uv pip install "harbor>=0.16.1".
• The result.json → trial adapter (build_trials_from_job_dir) is unchanged in both phases.
• Plan step 2.2 (docker network prune + n_concurrent_trials↔parallelism reconcile) is intentionally omitted: the runtime runs a single Harbor job for all tasks (no double fan-out), and a global network prune is destructive on shared hosts.

Test plan

• uv run --frozen pytest packages/nemo_evaluator_sdk/tests/agent_eval/test_harbor_runtime.py — 4 passed (adapter, discovery/loader/config, runner validation, and Phase-2 import scoping/cleanup + config validation; no Docker).
• uv run ruff check / uv run ruff format --check / uv run --frozen ty check on changed files.
• e2e (test_harbor_runtime_e2e.py) collects and skips cleanly without Harbor; runs reward == 1.0 locally with Harbor + Docker.

[SandyChapman]

I wonder if we shouldn't make these separate modes, but instead have job_dir act like a cache. If the task has a result in job_dir, we convert to a trial. If it's missing, we run the harbor task? It might fit better for a runner vs what we have with offline/online evals which expect an omitted target (runner).

[SandyChapman]

Think we could store the path on the task itself so that we don't need to pass dataset_path as an argument to the runner? Might need to make a subtype of AgentEvalTask for that to work though.