Feature: persist the agent's session and expose its path to graders

This is Harbor's approach — [`agents/installed/claude_code.py:1840`](https://github.com/harbor-framework/harbor/blob/main/src/harbor/agents/installed/claude_code.py) and `codex.py:56`. It removes the race outright: one trial, one known path, no hook, no session-id bookkeeping, and identical on every provider because the path is chosen rather than discovered. Harbor also refuses to guess when it *is* ambiguous — `_get_session_dir` returns `None` and logs rather than picking a file.

Worth teeing agent stdout at the same time. Harbor runs:

```
claude --verbose --output-format=stream-json --print 2>&1 | tee /claude-code.txt
```

because the final `{"type":"result", ..., "total_cost_usd": N}` line is the only authoritative cost figure Claude Code emits. That single line makes a cost grader trivial; reconstructing cost from the transcript cannot get there (see below).

Then copy `/` out to the results dir alongside the report, so a trial stays debuggable after its container is gone.

### 2. Tell graders where it is

```ts
export interface GraderInput {
task: string;
trial: number;
expected?: unknown;
metadata?: Record;
session?: {
format: 'claude-code-jsonl' | 'codex-rollout' | 'gemini-stream-json';
path: string; // in the same filesystem the grader runs in
stdout?: string; // teed agent stdout, when the adapter captures it
};
}
```

- **Path, not contents, by default.** A session holds every tool result verbatim and runs to megabytes; `SKILLGRADE_INPUT` is an env var. Graders execute in the same filesystem as the run, so a path is sufficient. Inlining can be opt-in per grader if anyone wants it.
- **`format` is the discriminator.** A grader that only understands one format fails loudly instead of silently misreading another.
- **Optional**, so an agent with no session file (or a hand-run grader) is still valid — which the current `messages: Message[]` design could not express.
- Named `session`, not `messages`: it is the agent's session, in whatever shape that agent writes.

## Rejected alternative: normalised `messages` (the original proposal)

This issue originally proposed a ChatML `messages: Message[]` on `GraderInput`. Backing away from it, for two reasons.

**It is lossy exactly where graders need signal.** Claude Code's session carries, per event:

- `duration_ms` per tool call
- `message.usage` — `input_tokens`, `output_tokens`, `cache_read_input_tokens`, `cache_creation_input_tokens`, and inside `cache_creation` the split between `ephemeral_1h_input_tokens` and `ephemeral_5m_input_tokens` (1h cache writes cost 2× input, 5m 1.25× — ignoring the split understated one of our runs by 35%)
- `message.id` — **required for correctness**, not a nicety: parallel tool calls share one message id and usage accumulates per streamed chunk, so summing naively inflated our token counts 2.0–2.8×
- `isSidechain` and `subagents/*.jsonl` for delegated turns
- `toolUseResult` with `stdout`, `stderr`, `exitCode`, `interrupted`

ChatML has nowhere to put any of it. A grader that wants the last assistant message can get it from the native file in three lines; a grader that wants cost or timing can't get it from ChatML at all.

**A normalised format is a project, not a field.** Harbor did exactly this and it took an RFC — [ATIF, RFC-0001](https://github.com/harbor-framework/harbor/blob/main/rfcs/0001-trajectory-format.md), now v1.7 — plus a per-agent adapter of ~1.5–1.9k lines each. And they *still* keep the native file as the lossless artifact, offering ATIF only as the portable one; their own docs say the conversion "keeps the conversation (messages, tool calls, tool results) but drops agent-specific session details."

So: ship the lossless artifact first, and let a normaliser be built on top of it if anyone wants one. That ordering works; the reverse doesn't.

## Out of scope

Cross-agent graders still have to branch on `format`, or use a helper. That's deliberate — a normaliser is a separate proposal, and it needs the persisted session to exist before it can be written or tested.

`sessionLog` (skillgrade's own record of the commands it issued) stays as-is and is worth keeping — it's the only place `agent_result` lives when an adapter has no session file at all.

Happy to implement.