feat(human_agent): let several people into one sandbox, with operators - #122

Built with resources/tmux.Dockerfile under linux/arm/v7; starts in busybox
with TERM=xterm-ghostty.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

… checks

- Who logged in now comes from dropbear itself: with `humans`, it runs with
  -E into a fresh file in a root-only directory, and the service keeps that
  log with each key fingerprint annotated "name, role". The access shell no
  longer writes a world-writable log a participant could edit or forge.
- The log is only read when `humans` was given, so a single-human run
  never ships a stale or planted file.
- Reject two humans with the same key material: sshd takes the first
  matching line, so one would get the other's role.
- An explicit `humans=[]` is rejected instead of silently falling back to
  the single-key setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

From review (Megan): two roles, not three. Operators now log in as root,
with their keys only in root's authorized_keys, so a root login naturally
skips the task user's .bashrc hooks (clock, recording, instructions); the
env marker only matters when the task user is itself root. The plain
same-user operator bought little, since its `task` limits were never a
security boundary, and crash rescue needs root anyway.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…a crash

From review (Megan): the point of operators is getting into a run that
ended badly, to rescue data or debug, and the sandbox already survives the
sample (hawk defaults runner.cleanup to false for human evals). Until now
the agent stopped dropbear whenever the sample ended, error included.

With operators, sample end (submit, quit, error, timeout, cancellation) now
revokes the participants' keys and disconnects them, and leaves dropbear up
for the operators, whose keys are root's; `hawk delete` ends it. Without
operators, teardown is unchanged.

Participants are found by the access shell's role marker, which their tmux
or VS Code server inherits too. Reading another user's
/proc/<pid>/environ needs CAP_SYS_PTRACE, which sandboxes drop, so the scan
runs as the participants' own user; root then kills only their dropbear
connections, never the listener. A Docker test crashes a sample with an
operator in: the operator still gets in as root, the participant key is
refused, and a detached process the participant left running is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

From review (Megan): a reader of the eval log should know how far to
trust the login record. It is written by dropbear as root, so operators
could edit it, and so could participants when the task runs as root. The
note is added as the log leaves the sandbox, so it can't be altered from
inside.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

… submit

From review (Megan): only `task submit` and `task quit` saved the login
record, so a run that errored, timed out or was cancelled lost it, and
that is when operators get in and a reviewer most needs to know who was
there. The service now reads it at the end of any other sample, under a
shield with its own deadline so it can't make the sample uncancellable.
A runner that dies outright still leaves it only in the sandbox.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>