Add per-eval Docker image override via evals.image property

[dgageot]

Allow each eval JSON to specify a custom Docker image through the
"image" field in the "evals" object, overriding the global --base-image
flag. The image build cache key now includes both workingDir and image
to correctly handle different images for the same working directory.

Assisted-By: docker-agent

[docker-agent]

Assessment: 🟢 APPROVE

This PR adds per-eval Docker image override functionality through the evals.image property. The implementation is sound:

Key Changes:

• Introduced imageKey struct combining workingDir and image for cache keys
• Modified getOrBuildImage to accept *session.EvalCriteria instead of just workingDir
• Added resolveBaseImage to prioritize per-eval image over global --base-image flag
• Updated preBuildImages to handle the new cache key structure
• Simplified Dockerfile template (removed docker-in-docker setup)

Verification Results:
All potential issues were investigated and dismissed:

• Zero-valued imageKey when eval.Evals is nil is intentional and correct (all evals without custom config should share the same base image)
• Singleflight correctly deduplicates concurrent builds and doesn't cache errors indefinitely
• All nil pointer access paths are guarded by callers

The cache key design correctly handles the case where multiple evals need the same image configuration, and the singleflight integration prevents redundant concurrent builds.

No issues found in the changed code.