feat(real-world-vfc-slice): add labeled OpenSSL/Firefox/Chromium/curl pair corpus

Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows)
into benchmarks/pairs/vfc with provenance and a JSONL training manifest.
Score the slice as an honesty dashboard (ousast pairs --slice vfc);
keep the pair gate on the local fixtures only.

benchmarks/pairs/vfc/firefox-cve-2020-15667/fixed.c

@@ -0,0 +1,59 @@
+/* Provenance: Firefox libmar mar_insert_item after CVE-2020-15667.
+ * repo: mozilla-central
+ * commit: b79b6cc78248eea7fda10bfb76aa273c19c9fa65
+ * parent: 0c0f777161a9499dd149853ff62d356f75d16c2a
+ * commit_url: https://hg.mozilla.org/mozilla-central/rev/b79b6cc78248eea7fda10bfb76aa273c19c9fa65
+ * phabricator: https://phabricator.services.mozilla.com/rMOZILLACENTRALb79b6cc78248eea7fda10bfb76aa273c19c9fa65
+ * cve: CVE-2020-15667
+ * bug: 1653371
+ * license: MPL-2.0
+ * function: mar_insert_item
+ * relpath: modules/libmar/src/mar_read.c
+ */
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+typedef struct MarItem_ {
+    struct MarItem_ *next;
+    uint32_t offset;
+    uint32_t length;
+    uint32_t flags;
+    char name[1];
+} MarItem;
+
+typedef struct {
+    MarItem *item_table[256];
+} MarFile;
+
+static uint32_t mar_hash_name(const char *name) {
+    (void)name;
+    return 0;
+}
+
+static int mar_insert_item(MarFile *mar, const char *name, uint32_t namelen, uint32_t offset, uint32_t length, uint32_t flags) {
+    MarItem *item, *root;
+    uint32_t hash;
+
+    item = (MarItem *)malloc(sizeof(MarItem) + namelen);
+    if (!item) {
+        return -1;
+    }
+    item->next = NULL;
+    item->offset = offset;
+    item->length = length;
+    item->flags = flags;
+    memcpy(item->name, name, namelen + 1);
+
+    hash = mar_hash_name(name);
+
+    root = mar->item_table[hash];
+    if (!root) {
+        mar->item_table[hash] = item;
+    } else {
+        /* append item */
+        while (root->next) root = root->next;
+        root->next = item;
+    }
+    return 0;
+}