feat(agent): complete EvoAgent integration for all 6 agent roles

Migrate all agent roles from Legacy to EvoAgent architecture:
- fundamentals_analyst, technical_analyst, sentiment_analyst, valuation_analyst
- risk_manager, portfolio_manager

Key changes:
- EvoAgent now supports Portfolio Manager compatibility methods (_make_decision,
  get_decisions, get_portfolio_state, load_portfolio_state, update_portfolio)
- Add UnifiedAgentFactory for centralized agent creation
- ToolGuard with batch approval API and WebSocket broadcast
- Legacy agents marked deprecated (AnalystAgent, RiskAgent, PMAgent)
- Remove backend/agents/compat.py migration shim
- Add run_id alongside workspace_id for semantic clarity
- Complete integration test coverage (13 tests)
- All smoke tests passing for 6 agent roles

Constraint: Must maintain backward compatibility with existing run configs
Constraint: Memory support must work with EvoAgent (no fallback to Legacy)
Rejected: Separate PM implementation for EvoAgent | unified approach cleaner
Confidence: high
Scope-risk: broad
Directive: EVO_AGENT_IDS env var still respected but defaults to all roles
Not-tested: Kubernetes sandbox mode for skill execution

scripts/run_prod.sh

@@ -1,4 +1,12 @@
 #!/usr/bin/env bash
+# COMPATIBILITY_SURFACE: stable
+# OWNER: ops-team
+# SEE: docs/legacy-inventory.md#gateway-first-production-example
+#
+# Gateway-first production launch script.
+# This is the current checked-in production example, running the gateway
+# directly and proxying /ws instead of exposing every split FastAPI service.
+# For split-service topology, see start-dev.sh and docs/current-architecture.md
 set -euo pipefail
 
 cd /root/code/evotraders
@@ -6,6 +14,17 @@ cd /root/code/evotraders
 export PYTHONPATH=/root/code/evotraders/.pydeps:.
 export TICKERS="${TICKERS:-AAPL,MSFT,GOOGL,AMZN,NVDA,META,TSLA,AMD,NFLX,AVGO,PLTR,COIN}"
 
+# 技能沙盒配置（生产环境建议使用 docker）
+export SKILL_SANDBOX_MODE="${SKILL_SANDBOX_MODE:-docker}"
+export SKILL_SANDBOX_IMAGE="${SKILL_SANDBOX_IMAGE:-python:3.11-slim}"
+export SKILL_SANDBOX_MEMORY_LIMIT="${SKILL_SANDBOX_MEMORY_LIMIT:-512m}"
+export SKILL_SANDBOX_CPU_LIMIT="${SKILL_SANDBOX_CPU_LIMIT:-1.0}"
+export SKILL_SANDBOX_NETWORK="${SKILL_SANDBOX_NETWORK:-none}"
+export SKILL_SANDBOX_TIMEOUT="${SKILL_SANDBOX_TIMEOUT:-60}"
+
+# "production" here is an explicit deployment run label, not a required
+# root-level runtime directory name.
+
 exec python3 -m backend.main \
   --mode live \
   --config-name production \