feat: add vf-run, a minimal in-process runner - #3047

Eligibility
Adds an opt-in in-process runner that saves traces and reports episode outcomes, reusing existing environment and storage APIs. Existing execution behavior remains unchanged, with result-directory protection and cancellation cleanup limiting the new path’s risk.

Additional Thinking

Code

Adds the opt-in vf-run CLI and typed configuration to execute selected taskset episodes through the existing environment API, save local traces/configuration, and report completion and reward. It bounds concurrency, rejects infinite selections and existing result directories, and unwinds sibling rollouts before environment teardown. Shared run identity helpers move without behavioral changes; integration coverage switches to the new runner and unit tests cover persistence guards and cancellation.

Review Context

The author is a repository admin and research team member; no code-ownership requirements were supplied. Review-thread checking reported four resolved threads and no unresolved comments or correctness findings. No check results or customer-specific guidelines were supplied. Added tests provide coverage evidence, not verified execution results.

Verdict

The new execution path requires explicit invocation and reuses existing environment, model-client, and trace-storage machinery. External model/runtime activity is limited to the requested taskset run, with existing defaults retained; no deployment, permission, retention, or existing evaluation behavior is materially changed. Local output guards and orderly resource cleanup limit remaining exposure, so no concrete material decision requires human judgment.

Notes:
No code owners found in target merge base 6d5edc7

Agent Credits: 30 credits
Approvability runs at a flat rate of 30 credits whenever the agent is asked for a verdict.