feat(agent): complete EvoAgent integration for all 6 agent roles

Migrate all agent roles from Legacy to EvoAgent architecture:
- fundamentals_analyst, technical_analyst, sentiment_analyst, valuation_analyst
- risk_manager, portfolio_manager

Key changes:
- EvoAgent now supports Portfolio Manager compatibility methods (_make_decision,
  get_decisions, get_portfolio_state, load_portfolio_state, update_portfolio)
- Add UnifiedAgentFactory for centralized agent creation
- ToolGuard with batch approval API and WebSocket broadcast
- Legacy agents marked deprecated (AnalystAgent, RiskAgent, PMAgent)
- Remove backend/agents/compat.py migration shim
- Add run_id alongside workspace_id for semantic clarity
- Complete integration test coverage (13 tests)
- All smoke tests passing for 6 agent roles

Constraint: Must maintain backward compatibility with existing run configs
Constraint: Memory support must work with EvoAgent (no fallback to Legacy)
Rejected: Separate PM implementation for EvoAgent | unified approach cleaner
Confidence: high
Scope-risk: broad
Directive: EVO_AGENT_IDS env var still respected but defaults to all roles
Not-tested: Kubernetes sandbox mode for skill execution

backend/skills/SKILL_TEMPLATE.md

@@ -117,3 +117,35 @@ evaluation_hook.complete_evaluation(success=True)
 ### 评估结果存储
 
 评估结果自动保存到 `runs/{run_id}/evaluations/{agent_id}/{skill_name}_{timestamp}.json`
+
+---
+
+## Skill Sandbox Execution | 技能沙盒执行
+
+技能脚本（如估值报告生成）通过沙盒执行器运行，支持三种隔离模式：
+
+| 模式 | 描述 | 适用场景 |
+|------|------|---------|
+| `none` | 直接执行，无隔离 | 开发环境（默认） |
+| `docker` | Docker 容器隔离 | 生产环境 |
+| `kubernetes` | Kubernetes Pod 隔离 | 企业级（预留） |
+
+### 沙盒配置
+
+环境变量控制沙盒行为：
+
+```bash
+SKILL_SANDBOX_MODE=none              # none | docker | kubernetes
+SKILL_SANDBOX_IMAGE=python:3.11-slim
+SKILL_SANDBOX_MEMORY_LIMIT=512m
+SKILL_SANDBOX_CPU_LIMIT=1.0
+SKILL_SANDBOX_NETWORK=none
+SKILL_SANDBOX_TIMEOUT=60
+```
+
+### 开发注意事项
+
+- 默认 `none` 模式会在首次执行时显示安全警告
+- 生产环境必须设置 `SKILL_SANDBOX_MODE=docker`
+- 技能脚本应无副作用，输入输出通过函数参数和返回值
+- 函数命名与脚本文件名的映射通过 `FUNCTION_TO_SCRIPT_MAP` 处理（如 `build_ev_ebitda_report` 在 `multiple_valuation_report.py` 中）