fix: add --extra-pip-packages to build_git_pr_image (shell-safe quoting)

[mvanhorn]

Summary

Adds an --extra-pip-packages option to build_git_pr_image.py so task instances that need additional runtime dependencies (the motivating case in #4 is MarkupPy for tablib, missing in pre-PR-554 instances) can be installed into the generated image without editing the script. The packages are appended as a RUN pip install ... layer after the base install command.

Why this matters

#4: instances built before PR-554 are missing MarkupPy, so tablib import fails and every such instance grades as failed regardless of the candidate solution. A configurable extra-packages flag lets the image builder add the missing dependency at build time.

Shell-safety detail

Pip requirement specifiers commonly contain < and > (requests>=2, urllib3<2). Because the package list is interpolated into a shell-form RUN line, those characters would be interpreted by the shell as redirection, silently installing the wrong requirement or failing the build. Each token is therefore split with shlex.split and re-quoted with shlex.quote before it is embedded, so specifiers survive intact while plain names are unchanged.

Testing

• pytest tests/test_codebase_adaptation_generic_runtime.py — 18 passed
• Covers: default omits the extra layer, single and multiple plain packages, empty value treated as default, and version specifiers (requests>=2 urllib3<2) are quoted rather than embedded raw.

Closes #4

AI was used for assistance.