Harden controlled agent study evaluation

[aryamthecodebreaker]

Summary

• freeze a 12-task machine-readable manifest for the controlled agent study
• require the complete task-by-arm cross product, global model/FixMap pins, and verified task/transcript hashes
• retain failed and timed-out runs, keep unsupported provider token counters null, and add rejection coverage
• align AGENT_STUDY and protocol documentation with the validator

Validation

• npm ci (0 vulnerabilities)
• npm run study:agent:test (18 passed)
• npm run study:agent:check
• npm run ci

No controlled model runs or paid API experiments were executed.