[codex] Harden public eval runtime

[scoootscooob]

Summary

• harden the ClawBench evaluator path with verifier-owned snapshots, protected asset hashing, trace archiving, and no-output runtime failure handling
• update OpenClaw container/runtime setup for Codex/OpenRouter lanes, plugin runtime dependencies, health probe skipping, and browser lane isolation
• align README, Space README, and public task docs with the evaluator snapshot model while ignoring local 100-suite artifacts and personal runtime state

Validation

• .venv/bin/python -m pytest -q -> 270 passed, 1 skipped
• git diff --check

Notes

The PR intentionally excludes local 100-suite task/result artifacts, Crabbox outputs, private tooling, payload tarballs, and the untracked partnership governance draft.