Private runners

Internal security testing needs local reach, strict authorization, and evidence handling that works without exposing private networks.