feat(headless): add the Reasonix benchmark arm

[Astro-Han]

Summary

Adds Reasonix (esengine/DeepSeek-Reasonix) as a competitor arm so Maka can be benchmarked head-to-head on deepseek-v4-flash. Refs #2076.

Reasonix is DeepSeek-native, which is what makes it the closest available comparison, but the harness had no way to run it: no pinned toolchain, no Harbor adapter, no registry entry. This lands the infrastructure on the existing two-arm path rather than a new one. Scheduling, resume identity, manifests, pricing, deadline policy, verifier, and report rendering are reused unchanged; the registry needs only an id and an import path, because DeepSeek already resolves to bearer auth and openai-chat-sse usage.

The first commit is a no-op refactor: each pinned arm was wired by hand in five places, and the mount ternary was already four levels deep. It collapses those into one table and moves the toolchain preparer, path-override env key, and runner option onto the competitor profile, so the profile is the single source of truth instead of being re-dispatched downstream. Splitting it out keeps the behaviour-preserving change reviewable and revertable on its own.

Three decisions worth flagging:

• Pinned Node as verifier only. Reasonix ships a static Go binary in @reasonix/cli-linux-x64, whose tarball layout is identical to opencode-linux-x64. It reuses the shared node-cli-toolchain implementation, and the pinned Node next to it is only the offline manifest verifier install() runs — exactly the role it already plays for the prebuilt OpenCode binary. Making node optional in the shared implementation would not perturb existing fingerprints (each is sha256 of its own spec constant), but it would widen the verification surface to save one cached download.
• stream-json, not --events-jsonl. internal/cli/run_output.go:265-270 passes tool names through machineOpaqueValue, so the redacted surface aliases real tool names away. All four existing competitor arms capture their CLI's native stream, and the arms are only comparable on tool behaviour if this one does too. The secrets that need protecting — the upstream key and the proxy token — never appear in the event stream either way.
• Pier is excluded from PierAgent. Terminal-Bench runs under plain Harbor. Letting the type admit an arm that has no mount would be a half-supported state.

Secret boundary

Reasonix has no flag or env override for a provider base_url (verified by grep over internal/ and cmd/), so the proxy route must come from config. It is written to an isolated $REASONIX_HOME/config.toml rather than the task workspace, and the key is referenced indirectly through api_key_env.

api_key_env does not read the process environment: ProviderEntry.APIKey() resolves it through storedCredentialValue(), which reads $REASONIX_HOME/.env and nothing else (internal/config/credentials.go:537, internal/config/paths.go:406). The token therefore has to be materialised in that file. It is written under umask 077 by shell expansion of the already-exported variable, so the value never appears in the command line, in config.toml, in the task workspace, or in any log. The credential proxy remains the authoritative source of token, cache, and cost evidence; Reasonix's self-reported total_cost is not used for settlement (its total_cost_usd alias is not converted when currency is CNY).

Verification

• npm --workspace @maka/headless run test (clean build + full suite): 1344 tests, 0 failures. The stream-verdict fix was reverse-verified: reverting it fails the suite.
• npm run format:check, npm run lint: clean.
• The refactor commit was verified on its own before the feature was applied: 1340 tests, 0 failures — the same suite minus the four new Reasonix tests.

New coverage:

• reasonix-toolchain.test.ts — pins the tarball integrity and binary SHA-256, and rejects a self-signed cache.
• harbor-adapter.test.ts — asserts the proxy token is absent from both the command line and the generated config, that reasonix.toml is never written to the workspace, that tool_result does not inflate tool-call counts, and that a self-reported is_error on a zero exit code still lands as runtime_error.
• harbor-task-runner.test.ts — mount, fingerprint env, no credential serialization, and version-drift refusal.
• harness-ab-cli.test.ts — composition, run identity, toolchain path, and env override.

Live smoke

One paired cell on configure-git-webserver (Terminal-Bench 2.1 @ d49e28f1), both arms on deepseek-v4-flash at max, against the real DeepSeek key through the credential proxy:

arm	outcome	scored	tokens (cached)	cost
maka	passed	yes	136 886 (122 624)	$0.0036
reasonix	passed	yes	672 080 (653 952)	$0.0064

The stream parser recovered the real session id and 35 tool calls with their real names — {bash: 23, todo_write: 5, complete_step: 5, write_file: 1, wait: 1} — which is the evidence that stream-json was the right surface: --events-jsonl would have aliased every one of those names away.

Two live findings no static review surfaced, both fixed in this branch:

• The proxy token never reached the CLI. api_key_env is not a process-environment lookup (see above); the run died at provider "maka-proxy/deepseek-v4-flash": missing env MAKA_REASONIX_PROXY_TOKEN. Fixed by writing $REASONIX_HOME/.env.
• Reasonix had silently disabled its own bash tool. Its default [sandbox] bash = "enforce" requires an OS sandbox and refuses bash outright when none exists; Terminal-Bench images ship no bubblewrap. The arm spent an entire trial writing a script it could never run, and lost the cell to verification_failed — a defect that would have been invisible in an aggregate score and would have understated Reasonix across the board. Pinning bash = "off" restores it to the same tool surface as every other arm, which all run unconfined inside the container that is itself the isolation boundary.

Remaining work

• Predeclared canary passes for both arms
• One full synchronized Terminal-Bench 2.1 run
• docs/eval/terminal-bench-2.1-deepseek-v4-flash-maka-vs-reasonix.{md,csv} report checked in