feat: add done-gate to prevent premature task completion

[abrichr]

Summary

• Adds a done-gate mechanism to the evaluation runner that verifies task completion before accepting the agent's done signal
• When the agent declares done, the runner calls adapter.evaluate(task) to check the actual score. If below threshold, the done is overridden and the agent receives a continuation message
• Opt-in via --done-gate flag (default off) to preserve existing behavior
• Configurable max overrides (--done-gate-max-overrides, default 3) and score threshold (--done-gate-threshold, default 1.0)

Root cause

The VS Code settings task (70745df8) agent declares already done after 1 step, misreading the UI. The font-change task agent sometimes quits early too. The step loop at line 341 in runner.py immediately breaks when action.type == done, with no verification.

Changes

• openadapt_evals/benchmarks/runner.py: Done-gate logic in _run_single_task(), new fields on EvaluationConfig
• openadapt_evals/benchmarks/cli.py: --done-gate, --done-gate-max-overrides, --done-gate-threshold flags on mock, run, and live commands
• scripts/run_dc_eval.py: Same flags, passed through to the benchmark CLI subprocess

Test plan

• Run openadapt-evals mock --tasks 1 (no done-gate) -- verify existing behavior unchanged
• Run openadapt-evals mock --tasks 1 --done-gate -- verify done-gate activates
• Run live eval with --done-gate against WAA VM to confirm premature done is overridden
• Verify max overrides limit prevents infinite loops