Bound Iris token-required launches to controller TTL

[penfever]

Implements the capability-token duration guard.

• Read the controller maximum from Marin/Iris source at runtime; do not duplicate the limit.
• Default token-required datagen/eval jobs to a bounded Iris timeout and reject unsafe explicit values.
• Keep terminus-2 unlimited and controller-token-free.
• Persist a secret-free policy manifest locally and with the task environment.
• Apply the same policy to the external federated OpenCode eval wrapper.

Tests: pytest tests/hpc/test_capability_token_duration.py tests/iris/test_launch_external_opencode_eval.py tests/hpc/test_resume_determinism.py tests/hpc/test_iris_launcher_args.py (32 passed).

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.