test(comment-review): promptfoo eval suite + root eval tooling

[grixu]

What

Turns the leftover skill-creator eval artifacts for the comment-review skill into a repeatable promptfoo eval suite, plus shared root-level tooling to run evals across the repo.

How the suite works

• Provider: native anthropic:claude-agent-sdk, loading comment-review as a local plugin and running the real skill with tools — on the Claude Code subscription (apiKeyRequired: false, no ANTHROPIC_API_KEY needed).
• 5 tests (one per fixture set), assertions ported from the saved eval_metadata.json / evals.json bullets as llm-rubric, plus a regex "skill ran" proxy (plugin skills load via Agent-Skills injection, so skill-used/skillCalls stay empty).
• Fixtures: 2 ported from the skill-creator workspace (payment-validator.ts, host-allowlist.ts) + 4 reconstructed from their assertion lists (datadog-integration.tf, scheduler.ts, dlq-codes.ts + dlq.handler.ts).

Baseline

	sonnet	opus
asserts	41 / 42	42 / 42

Two assertions are deliberately instructive:

• eval-3 §4.1 — genuine judgment boundary (after the spec-id is stripped the comment borders on R1). Accepts REWRITE or REMOVE; only "kept as-is" fails.
• eval-4 token-verification — real capability discriminator: kept strict. Sonnet takes a "letter+number ⇒ spec-id" shortcut and fails; opus shows the per-token check and passes.

Root tooling

• package.json — single shared node_modules, dev deps + eval scripts.
• scripts/run-evals.sh — discovers and runs every plugins/*/evals/promptfooconfig.yaml.
• pnpm-workspace.yaml — allowBuilds: false (avoids ERR_PNPM_IGNORED_BUILDS breaking pnpm 11's pre-run check).

Run

pnpm install
pnpm eval                 # all suites
pnpm eval:comment-review  # just this one

See plugins/comment-review/evals/README.md for details and knobs.