fix: evals only for those who can edit the agent

Evaluating builds datasets and runs against the agent, which is authoring: the agent page and the
editor offer it only with write access to the agent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

frontend/src/lib/components/flows/content/AgentEditorModal.svelte

@@ -411,8 +411,9 @@
 					/>
 				{/if}
 				<!-- Evals run against the deployed agent, and a draft-only one has none: the
-						     backend's `require_agent` would reject every run. -->
-				{#if !draftOnly}
+						     backend's `require_agent` would reject every run. Evaluating is authoring, so it
+						     is for those who can edit the agent. -->
+				{#if !draftOnly && !readOnly}
 					<Button
 						unifiedSize="sm"
 						variant="default"

frontend/src/routes/(root)/(logged)/agents/get/[...path]/+page.svelte

@@ -117,15 +117,18 @@
 					</ToggleButtonGroup>
 				{/if}
 				{#if config && !$userStore?.operator}
-					<Button
-						variant="default"
-						unifiedSize="md"
-						startIcon={{ icon: FlaskConical }}
-						title="Run this agent against a dataset of cases"
-						onClick={() => evalsModal?.openModal()}
-					>
-						Evals
-					</Button>
+					<!-- Evaluating an agent builds datasets and runs against it: authoring, as editing is. -->
+					{#if canEdit}
+						<Button
+							variant="default"
+							unifiedSize="md"
+							startIcon={{ icon: FlaskConical }}
+							title="Run this agent against a dataset of cases"
+							onClick={() => evalsModal?.openModal()}
+						>
+							Evals
+						</Button>
+					{/if}
 					<DropdownV2
 						placement="bottom-end"
 						size="md"