Fix Daytona computer-use image and add a single-task runner

[alanzabihi]

Closes #46, closes #47.

What changed:

• Added x11vnc and novnc to DESKTOP_PACKAGES in examples/node22-bookworm-computer-use-image.ts so Daytona sandbox.computerUse.start() can find the VNC/NoVNC bridge it needs.
• Added scripts/run-daytona-task.ts: a supported, type-checked, runSingle-based path for running one benchmark task end-to-end through a Daytona sandbox. It uses the built-in computer-use image by default, accepts --snapshot, and always awaits the benchmark grader before printing the result, so an unawaited score() Promise can no longer silently serialize as {}.
• Added tests for the image package list and the script's argument parsing / runner wiring / grader-score handling.
• Documented the new script in README.md.

Verification:

• npm run validate passes (22 test files, 296 tests).
• A live run of bountybench / lunary-0-exploit with transport: "daytona" and model: kimi-azure/kimi-k2.6 on the Hetzner server is the acceptance test for Computer-use fails to start on every Daytona sandbox: missing x11vnc/novnc packages #46/No supported path to run+score a single Daytona-transport task, forcing hand-rolled scripts that can silently drop scoring #47; non-empty oracleScore means the harness reached the grader.

---

Note

Low Risk
Developer tooling and image package additions with unit tests; no changes to auth, scoring logic, or production CLI paths beyond the new optional script.

Overview
Fixes the Node 22 bookworm computer-use image so Daytona computerUse.start() can bring up the VNC/NoVNC stack by adding x11vnc and novnc to the desktop package list, with a test that asserts both appear in the generated Dockerfile.

Introduces scripts/run-daytona-task.ts as the supported way to run one benchmark task end-to-end in a Daytona sandbox (default inline bookworm image or --snapshot). It wires an autobrin contender with transport: "daytona" through runSingle, prints the full JSON result, and fails with exit code 1 when the oracle score is missing or has no signals—addressing hand-rolled scripts that could print {} from an unawaited grader. README documents usage and optional flags.

^{Reviewed by Cursor Bugbot for commit 1bf345e. Configure here.}