Fix stale tier-xhard grader hash and guard locked fixtures

[TheGreatAxios]

Summary

• The tier-xhard grader pins the fixture's current hash instead of a stale one
• A hash mismatch reports a broken case when the workdir matches the fixture at setup, and an agent edit otherwise
• A locked-fixtures guard test fails any case whose TEST_SHA literal diverges from its fixture file

Pre-2026-09-11 tier-xhard results for this case are void: the grader fails every run at setup regardless of agent behavior.

Verification

• bun test evals/capability/locked-fixtures.test.ts passes, and fails naming tier-xhard when the literal is reverted
• bun test ./evals ./scripts passes (140 pass, 0 fail)
• bun run check passes (6980 pass, 0 fail)
• The grader messages exercise the real verify.sh in a scratch workdir across the pristine, agent-edited, and stale-literal paths

Fixes CL-7776

[linear-code]

CL-7776