[2/6][rollout] feat: container contract, workflow output types, in-container runner

[mathewjhan]

Part of splitting #272 into reviewable pieces (2/6).

What this adds

The data types and the in-container code that let a user's agent workflow run inside a task container and report results back to the host.

• ContainerInput / ContainerResult (container/files.py): the two JSON files exchanged with the container. The host stages container_input.json (rollout id, prompt, metadata, chat-completions URL, API key) before the agent starts; the agent phase writes container_result.json (status, error, workflow output) when it ends. write_reward writes the reward file at the path Harbor's verifier reads (/logs/verifier/reward.json).
• AgentWorkflowOutput (types/output.py): what a workflow's run() may return — one or more named message histories plus metrics. Returning nothing is also valid; the runner then collects the conversation recorded at the chat-completions endpoint.
• RolloutStatus (types/sample.py): one status vocabulary used everywhere — queued, running, grading, success, failure, cancelled, unknown. RolloutSample gains extra_fields for structured diagnostics.
• The runner (container/runner.py): the entrypoints that the generated bundle scripts call inside the container. agent_main reads the input file, runs the workflow, writes the result file, and saves the conversation as an ATIF trajectory.json next to the agent logs — the same location and format native Harbor agents use, so tools that read trajectories work on both. grader_main loads the agent's messages (from the result file, or from a trajectory file when the agent was not SDK code), runs the user's grader, and writes the reward. The grader reads its input from tests/ first: that copy may carry the ground-truth label, while the agent-phase copy has the label removed so the model can never read the answer.
• messages_from_trajectory (container/trajectories.py): converts a trajectory document (ATIF steps, or a raw messages list from a native harness) into plain chat messages.

Example

A workflow and grader written against these types:

class MyWorkflow(AgentWorkflow):
    async def run(self, ctx: AgentWorkflowContext) -> None:
        agent = StrandsAgent(model=ctx.config.model, messages=ctx.prompt)
        await agent.invoke_async()
        # returning None is fine: the recorded conversation becomes the sample

class MyGrader(Grader):
    async def grade(self, ctx: GraderContext) -> None:
        answer = ctx.sample.messages[-1]["content"]
        ctx.set_reward(1.0 if answer.strip() == ctx.label else 0.0)

Inside the container, the bundle's console scripts call agent_main(MyWorkflow, config) and grader_main(MyGrader, config); everything else in this PR is the plumbing those two calls rely on.