[codex] Fix code scanning alert 2 in generated config path flow

[jbeckwith-oai]

Summary

• keep the user-facing generated config path unchanged
• track a separate relative verify path for promptfoo eval inside the output directory
• add a regression test for generated file and verify paths

Root cause

CodeQL tracked the user-controlled output directory into the generated config path and then into the later promptfoo eval shell command.

Validation

• npm test -- src/generator/config-outputdir.test.ts
• npm run build

[jbeckwith-oai]

Superseded by #101 after collapsing the stacked promptfoo verification alerts into a single PR.

[jbeckwith-oai]

Closing this draft in favor of #101, which now carries alerts 1-3 together.