feat: Docker-isolated Claude CLI hello world

- evals/main.ts: run claude -p Hello in container, capture output
- evals/Dockerfile: node:24-slim + @anthropic-ai/claude-code@2.1.63
- evals:build: build image (run after Dockerfile changes)
- evals:run: run evals (requires image built first)
- ANTHROPIC_API_KEY from .env via --env-file-if-exists

evals/Dockerfile

@@ -0,0 +1,2 @@
+FROM node:24-slim
+RUN npm install -g @anthropic-ai/claude-code@2.1.63

evals/main.ts

@@ -0,0 +1,31 @@
+import { execSync, spawnSync } from "node:child_process";
+
+const apiKey = process.env.ANTHROPIC_API_KEY;
+if (!apiKey) throw new Error("ANTHROPIC_API_KEY required");
+
+try {
+	execSync("docker image inspect evals-claude", { stdio: "ignore" });
+} catch {
+	console.error("Docker image 'evals-claude' not found. Build it first with:\n  npm run evals:build");
+	process.exit(1);
+}
+
+const result = spawnSync(
+	"docker",
+	[
+		"run",
+		"--rm",
+		"-e",
+		`ANTHROPIC_API_KEY=${apiKey}`,
+		"evals-claude",
+		"claude",
+		"-p",
+		"Hello",
+	],
+	{ encoding: "utf-8" },
+);
+
+if (result.status !== 0) {
+	throw new Error(result.stderr || `Exit code ${result.status}`);
+}
+console.log(result.stdout);