Harden SWE agent test file parsing

[fallintoplace]

Summary

• replace eval() when decoding selected_test_files_to_run with JSON parsing plus a constrained ast.literal_eval() compatibility fallback
• validate that the decoded value is a list of strings before building the eval harness command
• shell-quote the joined test file argument so malicious filenames cannot break out of run_script.sh

Root cause

The NV-internal SWE harness treated dataset-provided selected_test_files_to_run metadata as executable Python. That let a malformed or malicious dataset row run arbitrary code in the agent process before test execution even started.

Validation

• uv run --extra dev python -m pytest responses_api_agents/swe_agents/tests/test_app.py

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.