Assorted fixes: clone-as-claude, test permissions, audit script

- Servo scrollend Dockerfiles: clone-as-claude pattern (create claude
  user before git clone, USER claude during clone, USER root after)
- Fix test.sh permissions (644→755) for envoy-dfp, envoy-udp, terraform
- Make TIMEOUT_MULTIPLIER overridable via env var in run_selected_tasks.sh
- Update audit_official_scores.py with improved config discovery and
  crash_failure detection

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sjarmak

benchmarks/ccb_build/servo-scrollend-event-feat-001/environment/Dockerfile

@@ -13,12 +13,19 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     pkg-config \
     && rm -rf /var/lib/apt/lists/*
 
+# Create claude user and writable work dirs before clone.
+RUN (adduser --disabled-password --gecos '' claude 2>/dev/null || true) && \
+    mkdir -p /workspace /logs && \
+    chown -R claude:claude /workspace /logs
+
 # Clone the actual Servo repository at pinned commit
 # This ensures BOTH baseline and MCP agents have identical file access
 # Note: Servo is a large Rust codebase (~1.6GB)
+USER claude
 RUN git clone --depth 1 https://github.com/sg-evals/servo--be6a2f99.git . && \
     git config user.email "agent@example.com" && \
     git config user.name "Agent"
+USER root
 
 # Task setup complete
 # Note: Both baseline and MCP agents now have access to the real Servo source.

benchmarks/ccb_build/servo-scrollend-event-feat-001/environment/Dockerfile.artifact_only

@@ -18,13 +18,20 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     pkg-config \
     && rm -rf /var/lib/apt/lists/*
 
+# Create claude user and writable work dirs before clone.
+RUN (adduser --disabled-password --gecos '' claude 2>/dev/null || true) && \
+    mkdir -p /workspace /logs && \
+    chown -R claude:claude /workspace /logs
+
 # Clone the actual Servo repository at pinned commit
 # This ensures BOTH baseline and MCP agents have identical file access
 # Note: Servo is a large Rust codebase (~1.6GB)
+USER claude
 RUN git clone --filter=blob:none --no-checkout https://github.com/servo/servo.git . && \
     git checkout be6a2f99a1e80060228f41280fd7d2178983e7ed && \
     git config user.email "agent@example.com" && \
     git config user.name "Agent"
+USER root
 
 # Task setup complete
 # Note: Both baseline and MCP agents now have access to the real Servo source.

benchmarks/ccb_fix/envoy-dfp-host-leak-fix-001/tests/test.sh

@@ -54,7 +54,7 @@ USE_CASE_CATEGORY_FILTER=""
 MODEL="${MODEL:-anthropic/claude-haiku-4-5-20251001}"
 CONCURRENCY=1        # harbor -n: trials per task
 PARALLEL_TASKS=0     # 0 = auto-detect from accounts; overridden by --parallel N
-TIMEOUT_MULTIPLIER=10
+TIMEOUT_MULTIPLIER="${TIMEOUT_MULTIPLIER:-10}"
 RUN_BASELINE=true
 RUN_FULL=true
 CATEGORY="${CATEGORY:-staging}"