feat(evaluators): new api from runners-api (#242)

## Summary
- Refactored Galileo Luna invocation so Agent Control calls runners-api
directly at `/api/v1/scorers/invoke`.
- Switched Luna auth to internal JWT only, signed with
`GALILEO_API_SECRET_KEY` or `GALILEO_API_SECRET`.
- Made `scorer_id` the required runtime identity; `scorer_label` is
optional metadata and `scorer_version_id` is optional pinning.
- Ensured requests always include `config: {}` and never forward
`Galileo-API-Key` to runners-api.

## Scope
- User-facing/API changes:
- Luna configs now require `scorer_id`; label-only and version-only
configs are rejected.
- Galileo Luna examples/docs now document `GALILEO_RUNNERS_API_URL`,
`GALILEO_LUNA_SCORER_ID`, and internal secret auth.

- Internal changes:
- Replaced API `/scorers/invoke` and `/internal/scorers/invoke` client
routing with runners-api routing.
  - Removed Luna auth mode selection and API URL/console URL derivation.
- Added tests for endpoint, JWT payload, scorer ID validation, version
forwarding, API-key stripping, and request body shape.

- Out of scope:
  - Agent Control UI changes.
  - runners-api/API service implementation changes.
- Scorer hydration, version resolution, caching, retries, or protect
execution logic inside Agent Control.

## Risk and Rollout
- **Compatibility note: `galileo.luna` now requires `scorer_id`.
`scorer_label` is optional display/metadata and `scorer_version_id` is
an optional version pin. Any saved Luna controls that only have
`scorer_label` or `scorer_version_id` must be re-saved through the UI or
manually updated to include the resolved `scorer_id` before they can be
evaluated with this version. The enterprise UI already resolves the
selected scorer and saves `scorer_id`.**
- Risk level: medium
- Rollback plan:
- Revert this PR to restore the previous API-mediated Luna invocation
path.
- If rollout exposes saved controls without `scorer_id`, migrate those
controls or temporarily roll back before retrying cutover.

## Testing
- [x] Added or updated automated tests
- [ ] Ran `make check` (targeted package validation was run instead)
- [x] Manually verified behavior

Targeted validation:
- `make -C evaluators/contrib/galileo test` -> 86 passed
- `make -C evaluators/contrib/galileo lint` -> passed
- `make -C evaluators/contrib/galileo typecheck` -> passed
- `git diff --check` -> clean

## Checklist
- [x] Linked issue/spec: RFC on direct runners-api scorer invoke
- [x] Updated docs/examples for user-facing changes
- [x] Included required follow-up tasks: confirm/migrate any legacy
saved Luna controls missing `scorer_id`

---------

Co-authored-by: abhinav-galileo <abhinav-galileo@users.noreply.github.com>

Author: namrataghadi-galileo

README.md

@@ -41,7 +41,7 @@ Enforce runtime guardrails through a centralized control layer—configure once
 
 ## Quick Start
 
-Prerequisites: Docker and Python 3.12+.
+Prerequisites: Docker (or Podman, see [Podman setup](#podman-setup)) and Python 3.12+.
 
 Quick start flow:
 
@@ -292,6 +292,51 @@ Explore working examples for popular frameworks.
 - [AWS Strands](examples/strands_agents/) - protect Strands workflows and tool calls
 - [Google ADK Decorator](examples/google_adk_decorator/) - add controls with `@control()`
 
+## Podman Setup
+
+If Docker Desktop is not available, you can use [Podman](https://podman-desktop.io) as a drop-in replacement. No changes to repo files are needed — the setup below makes `docker` and `docker compose` transparently resolve to Podman.
+
+**One-time setup:**
+
+1. Install [Podman Desktop](https://podman-desktop.io) and create a machine from its UI (start it before continuing).
+
+2. Install `podman-compose`:
+
+```bash
+brew install podman-compose
+```
+
+3. Create a `docker` shim that routes `docker compose` to `podman-compose` and everything else to `podman`:
+
+```bash
+mkdir -p ~/.local/bin
+cat > ~/.local/bin/docker << 'EOF'
+#!/bin/zsh
+if [[ "$1" == "compose" ]]; then
+  shift
+  exec podman-compose "$@"
+fi
+exec podman "$@"
+EOF
+chmod +x ~/.local/bin/docker
+```
+
+4. Add `~/.local/bin` early in your PATH (if not already):
+
+```bash
+echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
+source ~/.zshrc
+```
+
+**Verify:**
+
+```bash
+docker ps
+docker compose version
+```
+
+After this, all existing `docker`/`docker compose` commands and `make` targets work as-is.
+
 ## How It Works
 
 ![Agent Control Architecture](docs/images/Architecture.png)

evaluators/contrib/galileo/README.md

@@ -6,9 +6,13 @@ Integration package for Galileo Luna evaluator.
 
 The `galileo.luna2` evaluator ID has been removed. Existing controls that use
 `galileo.luna2` should migrate to `galileo.luna` and update their evaluator
-configuration to the direct Luna scorer fields (`scorer_label`, `scorer_id`, or
-`scorer_version_id`, plus `threshold` and `operator`). If you still need the
-legacy Luna2 evaluator, pin `agent-control-evaluator-galileo <8`.
+configuration to use the direct Luna scorer fields. `scorer_id` is required;
+`scorer_label` and `scorer_version_id` are optional. The evaluator calls the
+URL configured by `GALILEO_LUNA_INVOKE_URL`; the target must support the Luna
+scorer invoke request/response contract and internal Galileo secret auth. Also
+set `threshold` and `operator` as needed. If you still need the legacy Luna2
+evaluator, pin
+`agent-control-evaluator-galileo <8`.
 
 ## Install