Add BCAL package version controls

[martinsrui-msft]

Summary

• add a reusable authenticated BCal installer with latest-prerelease and exact pinned modes, strict input validation, stable retries, and structured installed-version verification
• discover the actual global BCal NuGet tool version before evaluation, verify --bcal-version / BCAL_PACKAGE_VERSION, and preserve the observed version in raw outcomes
• add per-matrix workflow version controls, focused package-version documentation, and parser/installer/workflow regression coverage

Stack

• stacked on Enable BCAL gold and challenge dataset panels #967 (martinsrui-bcal-single-turn-panels)
• multi-turn evaluation is deferred in Enable native BCAL multi-turn evaluation #968 and is not part of this PR
• intentionally excludes dataset changes, scenario behavior, import tooling, and repository release-version bumps

Validation

• 141 focused version/parser, PowerShell installer, workflow/action, CLI, panel, and agent-version result tests passed after rebasing directly onto Enable BCAL gold and challenge dataset panels #967
• Ruff check/format, targeted strict ty, applicable pre-commit hooks, and changed-YAML parsing passed
• committed diff contains exactly the 11 version-control-required files

[github-code-quality]

Code Coverage Overview

Languages: Python

Python / code-coverage/pytest

The overall line coverage in commit f1f4cd8 in the martinsrui-bcal-vers... branch is 88%. The line coverage in commit 52afb99 in the main branch is 87%.

Show a line coverage summary of the most impacted files.

File	main 52afb99	martinsrui-bcal-vers... f1f4cd8	+/-
src/bcbench/com...nds/evaluate.py	77%	79%	+2%
src/bcbench/age...bcal/version.py	0%	100%	+100%

---

_{Updated October 13, 2026 09:08 UTC}

[Wenjie Fan (gggdttt)]

1. Valid version pins can fail the version check. NuGet normalizes versions: 1.2.3+build.10 and 1.2.3.0 are reported as 1.2.3 by dotnet tool list. The string comparisons in Install-BCalTool.ps1 and verify_bcal_version() reject these even when the correct package is installed. Please compare using NuGet version rules and add tests for these cases.

2. The checked version may not belong to the executable we run. Version discovery checks the default global tool installation, but the agent finds bcal through PATH. If another BCAL installation comes first on PATH, the check can pass while we run a different version and record the wrong agent_version. Please use the same verified installation for both discovery and execution, or reject a path mismatch.

3. A mixed-version run is shown as a single-version run. Each matrix job installs the latest package separately, so a new package published during a run can produce results from different versions. The raw results keep those versions, but the summary and display only use the first result's version. Please show all versions or clearly mark the run as mixed, rather than label the whole run with the first version.

The merge-base changed after approval.