docs(architecture): use Promptfoo-native coding-agent evals

[christso]

Summary

• replace the proposed one-shot AllAgents Gateway with Promptfoo's built-in Claude Agent SDK and Codex SDK providers
• run each expanded evaluation row serially against ./.eval/workspace, recreated from a protected immutable seed by lifecycle extensions
• keep source staging, workspace reset, deterministic filesystem checks, receipts, cleanup, and disposable-job isolation as small job-owned glue
• use Promptfoo-native output, provider metadata, OpenTelemetry spans, and trajectory:* assertions instead of a custom provider and ATIF conversion
• document provider-specific sandbox, session, cache, deferred-grading, transcript, redaction, and cleanup limits
• retain the prior gateway, credential-broker, Harbor, and incumbent analysis as clearly labeled historical/future-service research
• document how the PR 679 Promptfoo experiment can move repository, workdir, cache, and skill setup out of top-level metadata into a source/workspace catalog plus fixed working_dir

Selected boundary

V1 is a trusted, single-tenant local/CI evaluation running inside a disposable rootless container or VM. Promptfoo owns matrices, repetitions, assertions, scoring, traces, and reports. The harness owns exact source staging and one private workspace copy per row.

Live-workspace assertions are deterministic-only. If semantic grading is also required, the deterministic phase persists unique row evidence and a separate evaluation grades that immutable artifact. Promptfoo currently logs afterEach failures rather than failing the command, so the extension writes receipts/failure sentinels and the job wrapper validates them before accepting a run.

A separate execution service is reconsidered only for concrete requirements such as hostile tenants, remote callers, strict per-row process isolation, credential/network phase separation, hidden verifiers, durable cancellation/recovery, mandatory ATIF, OMP support, or cross-machine retention and scheduling.

Verification

• bun run docs:build
• git diff --check
• all relative Markdown links and anchors resolve across the seven affected decision/plan/research documents
• final architecture review found no remaining high- or medium-priority findings

Documentation-only change; no CLI runtime behavior changed, so no CLI E2E was applicable.

[cloudflare-workers-and-pages]

Deploying allagents with    Cloudflare Pages

Latest commit:	c00ebc7
Status:	✅  Deploy successful!
Preview URL:	https://58bbe935.allagents.pages.dev
Branch Preview URL:	https://docs-execution-gateway-adr.allagents.pages.dev

View logs