Eval runner concurrency now coordinated through a token gate

What

• The eval case-runner (used to run evaluation test cases) was simplified from a loop that repeated a case N times with per-iteration cost and abort checks into a single-run function, and it now releases a tokenGate when one was acquired, only short-circuiting on an auth failure if no other reason for stopping has already been recorded.
• A new token rotation gate (a mutex-like mechanism with enter/leave/rotate actions) was added and is used by the eval login and gateway token refresh path, so that when multiple eval workers share the same credentials, only one of them refreshes the token at a time. It includes retry backoff and a "skip until" cache so a failing refresh isn't retried too aggressively.

Why

This prevents concurrent eval workers from stepping on each other while refreshing shared login credentials, and cleans up how the eval runner tracks whether it's still allowed to keep going.