feat(propose-adjudicate-prove): overlay adjudicates inventory before prove

Regex inventory stays the proposer. MAP attaches promote/demote/unadjudicated/coverage
from intra-file taint (tree-sitter when a grammar parses, Python ast as last resort).
Deep sandboxes promotions only, ordered by the existing heuristic ranker plus optional
OpenRouter mechanism recall. The SAST pair slice scores overlay outcomes; the stage-1
detection gate and local pair gate stay inventory-only.

benchmarks/pairs/github/node-serialize-cve-2017-5941/fixed.js

@@ -0,0 +1,6 @@
+// Fixed counterpart of the node-serialize CVE-2017-5941 eval pattern (CWE-95).
+function parsePayload(obj) {
+  return JSON.parse(obj);
+}
+
+module.exports = { parsePayload };