v0.37.1 — the verifier can read the solution again

Fixes a permission bug that made the arena refuse to run a submission on native Linux in two cases: the hidden-seed verifier (which clones each candidate into a private temp dir), and users running evolve/eval with a restrictive umask (077). The arena runs submissions as a non-root user and couldn't enter a 0700 solution directory, so every episode failed at turn 0. eval_batch now makes the solution mount traversable. Default-umask users and Docker Desktop were unaffected.

Sandbox images re-pinned at the same scoring major — verified leaderboard unaffected.