ci: fix the failures in the new test-race job

[aheritier]

Why

#4221 added a test-race job (go test -race -shuffle=on ./...) on pushes to main. Its first run ( 34493297831 ) failed while test-linux passed. Nothing in the merged code regressed: the race detector exposed pre-existing bugs that go test never saw. Two packages failed for four root causes; the ~15 other "race detected during execution of test" failures are collateral, since Go fails every test running when a race fires.

What

Commit	Root cause	Kind
fix(evaluation)	runDockerAgentInContainer read stderrData after cmd.Wait() while its own goroutine was still writing it; Wait does not wait for our goroutine. Stderr now goes through cmd.Stderr = &bytes.Buffer{}, which Wait (bounded by WaitDelay) synchronizes.	Production race
test(evaluation)	withVersion mutated the global version.Version from a t.Parallel() test while sibling parallel tests read it via DefaultAgentImage(). Extracted a pure defaultAgentImageFor(v) and table-test that instead; nothing writes version.Version from tests any more.	Test-only race
test(tui) freeze clock	TestActualProgramScrollCancelResizeMatrixNeverNeedsRecoveryClick compares two frames taken milliseconds apart; under -race a spinner TickMsg lands between them and advances the glyph. New frozenClockRoot builds the harness on a scheduler that never schedules a tick, used by the three exact-frame tests. Perf/geometry tests stay on wallClockRoot.	Flaky assertion
test(tui) teardown	When that assertion failed, require aborted before program.Quit(), leaking a live render loop whose View() read styles globals while later tests called styles.ApplyTheme. New startTestProgram helper quits, waits (bounded) and stops the runtime in t.Cleanup; all eight inline program starts use it.	Test hygiene

Verification

• go test -race -shuffle=on -count=5 ./pkg/evaluation: clean.
• go test -race -count=20 -run 'TestActualProgram|TestColorScheme|TestHandleChangeTheme' ./pkg/tui: clean.
• Forcing the matrix assertion to fail now fails only that test; the theme tests no longer race.
• task lint passes.

Not in this PR

A shuffled full pkg/tui race run still fails ~1 in 5 on TestLoadSessionThenClickEditLabel, from an unrelated production race in pkg/app (App.Start's goroutine reads a.session while ReplaceSession writes it). That one was not in run 34493297831 and is tracked and fixed separately.