feat: add sourcegraph_only config with Dockerfiles and run scripts

Implements the "upper bound" MCP config where agents have NO local
source code and must use Sourcegraph MCP for all code access.

Phase 2: sourcegraph_only agent code (in evals repo, committed separately)
Phase 3: 14 Dockerfile.sg_only files for write-only suites
  - 5 K8s Docs (target dir only, no repo clone)
  - 5 LinuxFLBench (minimal image, no kernel)
  - 4 Investigation (no repo clone, output-only)
Phase 4: Verifier wrapper + build-suite run script
  - sgonly_verifier_wrapper.sh: restore/overlay for build tasks
  - sgonly_build_2config.sh: SWE-bench Pro, PyTorch, Enterprise
  - sgonly_writeonly_2config.sh: K8s Docs, LinuxFLBench, Investigation

Also adds sourcegraph_only to eval_matrix.json supported_configs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: LoCoBench Bot

benchmarks/ccb_investigation/inv-debug-001/environment/Dockerfile.sg_only

@@ -0,0 +1,23 @@
+FROM golang:1.23-bookworm
+
+WORKDIR /workspace
+
+# Install dependencies
+RUN apt-get update && apt-get install -y \
+    git \
+    curl \
+    python3 \
+    npm \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Claude Code CLI
+RUN npm install -g @anthropic-ai/claude-code
+
+# NO repo clone — agent uses Sourcegraph MCP exclusively for code access.
+# Investigation tasks produce /logs/agent/investigation.md only.
+RUN git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
+# Create output directories
+RUN mkdir -p /logs/agent /logs/verifier /app

benchmarks/ccb_investigation/inv-impact-001/environment/Dockerfile.sg_only

@@ -0,0 +1,23 @@
+FROM golang:1.23-bookworm
+
+WORKDIR /workspace
+
+# Install dependencies
+RUN apt-get update && apt-get install -y \
+    git \
+    curl \
+    python3 \
+    npm \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Claude Code CLI
+RUN npm install -g @anthropic-ai/claude-code
+
+# NO repo clone — agent uses Sourcegraph MCP exclusively for code access.
+# Investigation tasks produce /logs/agent/investigation.md only.
+RUN git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
+# Create output directories
+RUN mkdir -p /logs/agent /logs/verifier /app

benchmarks/ccb_investigation/inv-migration-001/environment/Dockerfile.sg_only

@@ -0,0 +1,22 @@
+FROM python:3.12-bookworm
+
+WORKDIR /workspace
+
+# Install dependencies
+RUN apt-get update && apt-get install -y \
+    git \
+    curl \
+    npm \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Claude Code CLI
+RUN npm install -g @anthropic-ai/claude-code
+
+# NO repo clone — agent uses Sourcegraph MCP exclusively for code access.
+# Investigation tasks produce /logs/agent/investigation.md only.
+RUN git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
+# Create output directories
+RUN mkdir -p /logs/agent /logs/verifier /app

benchmarks/ccb_investigation/inv-regression-001/environment/Dockerfile.sg_only

@@ -0,0 +1,23 @@
+FROM golang:1.23-bookworm
+
+WORKDIR /workspace
+
+# Install dependencies
+RUN apt-get update && apt-get install -y \
+    git \
+    curl \
+    python3 \
+    npm \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Claude Code CLI
+RUN npm install -g @anthropic-ai/claude-code
+
+# NO repo clone — agent uses Sourcegraph MCP exclusively for code access.
+# Investigation tasks produce /logs/agent/investigation.md only.
+RUN git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
+# Create output directories
+RUN mkdir -p /logs/agent /logs/verifier /app

benchmarks/ccb_linuxflbench/lfl-acpi-207835/environment/Dockerfile.sg_only

@@ -0,0 +1,23 @@
+FROM gcc:13-bookworm
+
+WORKDIR /workspace
+
+# Install dependencies (no kernel clone needed — agent uses MCP for code access)
+RUN apt-get update && apt-get install -y \
+    git \
+    curl \
+    ripgrep \
+    python3 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Node.js and Claude Code CLI
+RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
+    apt-get install -y nodejs && \
+    npm install -g @anthropic-ai/claude-code
+
+# NO kernel source — agent reads kernel code via Sourcegraph MCP,
+# writes JSON answer locally.
+RUN mkdir -p /workspace /tests /logs /app && \
+    git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"

benchmarks/ccb_linuxflbench/lfl-nfs-117651/environment/Dockerfile.sg_only

@@ -0,0 +1,23 @@
+FROM gcc:13-bookworm
+
+WORKDIR /workspace
+
+# Install dependencies (no kernel clone needed — agent uses MCP for code access)
+RUN apt-get update && apt-get install -y \
+    git \
+    curl \
+    ripgrep \
+    python3 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Node.js and Claude Code CLI
+RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
+    apt-get install -y nodejs && \
+    npm install -g @anthropic-ai/claude-code
+
+# NO kernel source — agent reads kernel code via Sourcegraph MCP,
+# writes JSON answer locally.
+RUN mkdir -p /workspace /tests /logs /app && \
+    git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"

benchmarks/ccb_linuxflbench/lfl-sata-203475/environment/Dockerfile.sg_only

@@ -0,0 +1,23 @@
+FROM gcc:13-bookworm
+
+WORKDIR /workspace
+
+# Install dependencies (no kernel clone needed — agent uses MCP for code access)
+RUN apt-get update && apt-get install -y \
+    git \
+    curl \
+    ripgrep \
+    python3 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Node.js and Claude Code CLI
+RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
+    apt-get install -y nodejs && \
+    npm install -g @anthropic-ai/claude-code
+
+# NO kernel source — agent reads kernel code via Sourcegraph MCP,
+# writes JSON answer locally.
+RUN mkdir -p /workspace /tests /logs /app && \
+    git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"

benchmarks/ccb_linuxflbench/lfl-sound-53441/environment/Dockerfile.sg_only

@@ -0,0 +1,23 @@
+FROM gcc:13-bookworm
+
+WORKDIR /workspace
+
+# Install dependencies (no kernel clone needed — agent uses MCP for code access)
+RUN apt-get update && apt-get install -y \
+    git \
+    curl \
+    ripgrep \
+    python3 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Node.js and Claude Code CLI
+RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
+    apt-get install -y nodejs && \
+    npm install -g @anthropic-ai/claude-code
+
+# NO kernel source — agent reads kernel code via Sourcegraph MCP,
+# writes JSON answer locally.
+RUN mkdir -p /workspace /tests /logs /app && \
+    git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"

benchmarks/ccb_linuxflbench/lfl-wifi-206661/environment/Dockerfile.sg_only

@@ -0,0 +1,23 @@
+FROM gcc:13-bookworm
+
+WORKDIR /workspace
+
+# Install dependencies (no kernel clone needed — agent uses MCP for code access)
+RUN apt-get update && apt-get install -y \
+    git \
+    curl \
+    ripgrep \
+    python3 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Node.js and Claude Code CLI
+RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
+    apt-get install -y nodejs && \
+    npm install -g @anthropic-ai/claude-code
+
+# NO kernel source — agent reads kernel code via Sourcegraph MCP,
+# writes JSON answer locally.
+RUN mkdir -p /workspace /tests /logs /app && \
+    git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"

configs/eval_matrix.json

@@ -9,6 +9,7 @@
     "sourcegraph_base",
     "sourcegraph_full",
     "sourcegraph_isolated",
+    "sourcegraph_only",
     "github_base",
     "github_full"
   ],