feat(benchmark): add optional Atlas VLM provider

[binyangzhu000-sudo]

Summary

• add opt-in Atlas Cloud VLM execution for the home-security benchmark
• require explicit paid confirmation and environment-only credentials
• disable SDK retries for Atlas and allow VLM-only runs without a local LLM

Validation

• npm ci --ignore-scripts (0 vulnerabilities)
• npm test (32 assertions passed)
• node --check scripts/run-benchmark.cjs
• CLI help and fail-fast gate checks
• exactly one live Atlas smoke returned HTTP 402 (insufficient balance); it was not retried

Safety

• local Aegis remains the default path
• Atlas is enabled only with --atlas-vlm --confirm-paid-atlas
• credentials are read from environment variables and are not accepted as CLI arguments