feat: add empirical difficulty evaluator

[Suiseiseki-2016]

Summary

• add an independent empirical difficulty evaluator for Atom and Range subjects
• evaluate four default NewAPI Qwen models under equal turn and timeout budgets
• report verifier-confirmed success rate, turns, wall time, tool calls, score, label, and confidence as standalone JSON
• isolate Range runs with temporary copies and keep canonical Atoms, templates, and verification records unchanged
• expose cvelab difficulty atom and cvelab difficulty range CLI commands

Validation

• Ruff passed for the changed evaluator, CLI, agent, and test files
• 34 focused tests passed across evaluator, agent runner, and researcher tests
• live smoke Range (dmz_simple, CVE-2012-1823): 4/4 successes, easy, score 10.05
• live enterprise Range (enterprise_3tier): 0/4 successes, very_hard, score 80.0

Runtime caveat

The live evaluations used disposable noncanonical runtime-image rebindings because the historical repository-pinned images were unavailable. Digest provenance was recorded outside the repository; canonical Atoms, templates, Ranges, and committed code were not modified for those runs.