fix: code scanning alerts 1-3 in promptfoo verification flow

[jbeckwith-oai]

Summary

• separate user-facing generated config paths from the stable verification path
• keep custom config filenames while also writing a stable promptfooconfig.yaml alias
• run promptfoo eval via execFileSync with explicit argv instead of a shell command
• preserve the existing verify timeout and diagnostic parsing
• add regression tests for output-dir handling, custom filenames, and eval invocation

Root Cause

CodeQL split the promptfoo verification issue into three linked dataflow alerts:

• alert 1: the verify path flowed into the later promptfoo eval shell command
• alert 2: outputDir flowed into the generated config path
• alert 3: filename flowed into the generated config path

This PR collapses that stacked series into one change set that fixes the full path from config generation through verification.

Validation

• npm test -- src/agent/loop-eval.test.ts src/generator/config-filename.test.ts src/generator/config-outputdir.test.ts
• npm run build