feat(runner): verbs-only bench run with --shape and --run-key - #264

Sandboxed PR scan did not produce a valid agent receipt. No existing Superagent clean scan comments (<!-- brin-pr-scan -->) found. The existing Superagent finding comment is on .github/workflows/sandbox-tti-benchmarks.yml, which is in reviewedFindingPaths — I skip it.

Now let me analyze the full PR for security findings across all scan areas. Let me examine the changed source files in depth to be sure I haven't missed anything.