[codex] Fix code scanning alert 3 in generated config filename flow

[jbeckwith-oai]

Summary

• keep the requested config filename for the user-facing output
• write a stable promptfooconfig.yaml alias for verification
• add a regression test for custom filenames plus the stable verify alias

Root cause

After the output-directory flow was separated, CodeQL still tracked the caller-controlled filename into the verify path that eventually reached promptfoo eval.

Validation

• npm test -- src/generator/config-filename.test.ts src/generator/config-outputdir.test.ts
• npm run build

[jbeckwith-oai]

Superseded by #101 after collapsing the stacked promptfoo verification alerts into a single PR.

[jbeckwith-oai]

Closing this draft in favor of #101, which now carries alerts 1-3 together.