fix: harden agent, benchmark, and UI against security, correctness, and stability issues

[AceronX]

Summary

Repo-wide review follow-up. Fixes security, correctness, and stability issues across the Python agent/runtime, imagent-bench, and imagent-ui. One atomic change set; no behavior changes to intended designs (those are documented in-code instead).

Motivation

A careful review of all sub-projects surfaced a credential leak, untrusted-code-with-secrets exposure, a reproducible agent crash, and several unauthenticated/DoS-prone UI endpoints, plus assorted correctness and test-hygiene gaps.

Changes

Critical

• imagent-bench: strip embedded credentials in _normalize_repository_identifier so remote-URL tokens can't leak into benchmark-report.json.
• round_manager: run untrusted candidate code with a scrubbed env (drops GITHUB_TOKEN/GH_TOKEN, keeps OPENROUTER_API_KEY).

Python agent / runtime

• Fix SyntaxError crash in _extract_expression (dates, "8+").
• Handle allowed_tools: null; read all JSON assets; restrict _image_bytes_from_url to http(s).
• requires-python -> >=3.11; stop CLI defaults clobbering --config-json values.

imagent-bench

• Vision-judge retry/backoff; close log handle; guard _percentile p=100; fix misleading ranking label; tolerate non-int ID/seed; dedupe sys.path; document intentional judge/raster limits.

imagent-ui

• New lib/security.ts: rate limiter, concurrency cap, client-IP, optional IMAGENT_UI_API_SECRET auth gate.
• generate/verify: auth gate, rate limits, subprocess timeout+kill, input validation, generic errors, run-dir pruning.
• Reject ./.. run ids; never serve SVG inline (+nosniff); security headers in next.config.mjs and Caddyfile; remove dead attach-image UI + orphaned CSS.

Testing

• python -m pytest tests imagent-bench/tests -> 39 passed.
• imagent-ui: npm run lint clean, npm run build succeeds (15 routes).

[github-actions]

This PR was closed because the active competition accepts only scoped Leaderboard UI submissions.

• The active competition accepts only Leaderboard UI submissions. Select Leaderboard UI in the PR template.

Update the PR title, description, and files, then reopen the PR.

[github-actions]

This PR was closed because the active competition accepts only scoped Leaderboard UI submissions.

• The active competition accepts only Leaderboard UI submissions. Select Leaderboard UI in the PR template.

Update the PR title, description, and files, then reopen the PR.