feat(eval): add an --engine flag with capability aware selection

[theonly1me]

What changed

• Added shadowclone eval --engine <id>, validated against the shared engineIds list with a clear error naming the known engines.
• Extracted engine selection into src/eval/engine.ts as selectEvalRunner, keeping src/eval/run.ts under the line limit.
• A rejected engine now says why: not installed, not authenticated, or unable to enforce a budget and a granular tool policy.
• Exported engineIds from src/config so the CLI validates against one list rather than a copy.

Why

runEval hardcoded detectEngine({ purpose: "dispatch" }) with no way to choose, so the engine was whichever qualified first. On a machine with several authenticated CLIs there was no way to say which one should run the eval, and a failure printed a single generic line.

--engine narrows selection, it does not override the gate. A named engine still has to be permitted by managed policy, be authenticated, and support the purpose. Asking for one that cannot enforce a budget and a granular tool policy fails with that reason rather than silently falling back.

How to verify

bun run check
bun run cli eval --engine antigravity --sessions 1

The second command exits with The antigravity engine cannot run eval because it is not installed, since no Antigravity runner exists. --engine bogus lists the known engines.

selectEvalRunner takes the existing CommandProbe, so src/eval/engine.test.ts runs hermetically in 9ms instead of shelling out to every CLI.