gaia: re-enable harness isolation (harness_user: harness)

Now that the sidecar image pre-warms the harness uv cache, the inner eval
runs as the unprivileged harness user again, so the candidate harness cannot
read the held-out records, budgets, or admin token.

Author: varunursekar

harness-engineering-bench/gaia/baseline/build.yaml

@@ -66,8 +66,8 @@ secrets:
   - WANDB_API_KEY
   - WANDB_BASE_URL  # self-hosted W&B (scaleai.wandb.io)
 
-# off: breaks the eval's uv resolution of gaia_agent; needs an isolation fix.
-harness_user: null
+# candidate harness runs as an unprivileged uid, unable to read held-out state.
+harness_user: harness
 
 wandb:
   project: vero-gaia