feat(agent): complete EvoAgent integration for all 6 agent roles

Migrate all agent roles from Legacy to EvoAgent architecture:
- fundamentals_analyst, technical_analyst, sentiment_analyst, valuation_analyst
- risk_manager, portfolio_manager

Key changes:
- EvoAgent now supports Portfolio Manager compatibility methods (_make_decision,
  get_decisions, get_portfolio_state, load_portfolio_state, update_portfolio)
- Add UnifiedAgentFactory for centralized agent creation
- ToolGuard with batch approval API and WebSocket broadcast
- Legacy agents marked deprecated (AnalystAgent, RiskAgent, PMAgent)
- Remove backend/agents/compat.py migration shim
- Add run_id alongside workspace_id for semantic clarity
- Complete integration test coverage (13 tests)
- All smoke tests passing for 6 agent roles

Constraint: Must maintain backward compatibility with existing run configs
Constraint: Memory support must work with EvoAgent (no fallback to Legacy)
Rejected: Separate PM implementation for EvoAgent | unified approach cleaner
Confidence: high
Scope-risk: broad
Directive: EVO_AGENT_IDS env var still respected but defaults to all roles
Not-tested: Kubernetes sandbox mode for skill execution

.env.example

@@ -26,6 +26,10 @@ EXPLAIN_RANGE_USE_LLM=
 # Memory module
 MEMORY_API_KEY=
 
+# Experimental EvoAgent rollout for selected analysts only.
+# Example: EVO_AGENT_IDS=fundamentals_analyst,risk_manager,portfolio_manager
+EVO_AGENT_IDS=
+
 # ================== Agent-Specific Model Configuration | Agent特定模型配置 ==================
 AGENT_SENTIMENT_ANALYST_MODEL_NAME=deepseek-v3.2-exp
 AGENT_TECHNICAL_ANALYST_MODEL_NAME=glm-4.6
@@ -35,6 +39,20 @@ AGENT_RISK_MANAGER_MODEL_NAME=qwen3-max-preview
 AGENT_PORTFOLIO_MANAGER_MODEL_NAME=qwen3-max-preview
 
 # ================== Advanced Configuration | 高阶配置 ==================
+
+# Skill Sandbox Mode | 技能沙盒执行模式
+# none = direct execution (default, development only) | 直接执行（默认，仅开发环境）
+# docker = Docker container isolation | Docker 容器隔离
+# kubernetes = Kubernetes Pod isolation (reserved) | Kubernetes Pod 隔离（预留）
+SKILL_SANDBOX_MODE=none
+
+# Docker Sandbox Settings (only used when SKILL_SANDBOX_MODE=docker) | Docker 沙盒配置
+SKILL_SANDBOX_IMAGE=python:3.11-slim
+SKILL_SANDBOX_MEMORY_LIMIT=512m
+SKILL_SANDBOX_CPU_LIMIT=1.0
+SKILL_SANDBOX_NETWORK=none
+SKILL_SANDBOX_TIMEOUT=60
+
 MAX_COMM_CYCLES=2
 MARGIN_REQUIREMENT=0.5
 DATA_START_DATE=2022-01-01