Restrict builtins in AssertionEvaluator eval fallback path

[Copilot]

The AssertionEvaluator fallback eval passed inputs directly as globals/locals, leaving __builtins__ unrestricted and reintroducing arbitrary code execution that the restricted-builtins model was meant to prevent.

Changes

• Fallback path hardened: replaces eval(self.condition, inputs, inputs) with a restricted env using SAFE_ASSERTION_BUILTINS, matching the primary _eval_assertion_restricted path
• __builtins__ override prevention: both primary and fallback paths now use {**inputs, "__builtins__": SAFE_ASSERTION_BUILTINS} so a caller-controlled inputs key cannot shadow the restriction
• pow added to SAFE_ASSERTION_BUILTINS: safe math builtin previously only reachable via the unrestricted fallback; making it explicit maintains backward compatibility

# Before — full builtins exposed in fallback
eval(self.condition, inputs, inputs)

# After — same restriction as primary path
fallback_env = {**inputs, "__builtins__": SAFE_ASSERTION_BUILTINS}
eval(self.condition, fallback_env, fallback_env)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.