fix(agents): Default-Vault-Pfad nach /tmp damit Container-User schreiben kann

/app/artifacts gehört root und appuser darf nicht mkdir machen — Endpoint
crashte mit PermissionError. Default jetzt /tmp/breakpilot/agent_runs.
EVIDENCE_VAULT_ROOT-Env-Var bleibt für persistente Volumes nutzbar.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend-compliance/compliance/services/specialist_agents/_evidence_vault.py

@@ -50,9 +50,10 @@ logger = logging.getLogger(__name__)
 
 
 def _vault_root() -> Path:
-    """Resolved at call time so tests can monkeypatch the env var."""
+    """Resolved at call time so tests can monkeypatch the env var.
+    Default to /tmp so the appuser can always write (container-friendly)."""
     return Path(os.environ.get(
-        "EVIDENCE_VAULT_ROOT", "/app/artifacts/agent_runs",
+        "EVIDENCE_VAULT_ROOT", "/tmp/breakpilot/agent_runs",
     ))