test(coach): register the live scenario run with the egress and env guards

run-case.ts now calls a provider for the live scenario run, and judge.ts
reads COACH_EVAL_SCENARIO_REPEATS. Both belong to the offline evaluation
harness, like the judge and its model knobs.

src/__tests__/ai-egress-capability-guard.test.ts

@@ -147,6 +147,11 @@ const EGRESS_SITES: Record<string, EgressSite> = {
     recheck: false,
     reason: "The offline evaluation harness; never on a request or job path.",
   },
+  "lib/ai/coach/eval/run-case.ts": {
+    recheck: false,
+    reason:
+      "The offline evaluation harness's live scenario run, called only by judge.ts; never on a request or job path.",
+  },
 };
 
 describe("AI egress call sites", () => {

src/__tests__/compose-env-whitelist-guard.test.ts

@@ -131,6 +131,8 @@ const NOT_OPERATOR_CONFIGURABLE: Readonly<Record<string, string>> = {
     "repository secret for the nightly model-graded Coach eval; that workflow runs in CI, never in the app image",
   COACH_EVAL_GENERATOR_MODEL: "CI-only knob for the same nightly eval workflow",
   COACH_EVAL_JUDGE_MODEL: "CI-only knob for the same nightly eval workflow",
+  COACH_EVAL_SCENARIO_REPEATS:
+    "CI-only knob for the same nightly eval workflow",
   HEALTHLOG_MCP_TOKEN:
     "read by the local stdio MCP bridge the operator runs on their own machine; the production image strips tsx so it cannot run there",