fix(evals): address Greptile review feedback

- Make company_boundary test adversarial with cross-company stimulus
- Replace fragile not-contains:retry with targeted JS assertion
- Replace not-contains:create with not-contains:POST /api/companies
- Pin promptfoo to 0.103.3 for reproducible eval runs
- Fix npm -> pnpm in README prerequisites
- Add trailing newline to system prompt

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Paperclip <noreply@paperclip.ing>

package.json

@@ -32,7 +32,7 @@
     "smoke:openclaw-sse-standalone": "./scripts/smoke/openclaw-sse-standalone.sh",
     "test:e2e": "npx playwright test --config tests/e2e/playwright.config.ts",
     "test:e2e:headed": "npx playwright test --config tests/e2e/playwright.config.ts --headed",
-    "evals:smoke": "cd evals/promptfoo && npx promptfoo@latest eval"
+    "evals:smoke": "cd evals/promptfoo && npx promptfoo@0.103.3 eval"
   },
   "devDependencies": {
     "@changesets/cli": "^2.30.0",