feat(propose-adjudicate-prove): overlay adjudicates inventory before prove

Regex inventory stays the proposer. MAP attaches promote/demote/unadjudicated/coverage
from intra-file taint (tree-sitter when a grammar parses, Python ast as last resort).
Deep sandboxes promotions only, ordered by the existing heuristic ranker plus optional
OpenRouter mechanism recall. The SAST pair slice scores overlay outcomes; the stage-1
detection gate and local pair gate stay inventory-only.

benchmarks/pairs/github/sven-cwe-078-shell-true/fixed.py

@@ -0,0 +1,22 @@
+# Provenance: SVEN train CWE-78 function pair from
+# https://github.com/google/mobly/commit/3862e8ba359040fbdd6e1a6d36e51d07cda8e1ee
+# file mobly/controllers/android_device_lib/adb.py function _exec_cmd
+import logging
+import subprocess
+
+
+class AdbError(Exception):
+    def __init__(self, **kwargs):
+        super().__init__(kwargs)
+
+
+class Adb:
+    def _exec_cmd(self, args, shell):
+        """Executes adb commands."""
+        proc = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=shell)
+        (out, err) = proc.communicate()
+        ret = proc.returncode
+        logging.debug("cmd: %s, stdout: %s, stderr: %s, ret: %s", args, out, err, ret)
+        if ret == 0:
+            return out
+        raise AdbError(cmd=args, stdout=out, stderr=err, ret_code=ret)

benchmarks/pairs/github/sven-cwe-078-shell-true/vuln.py

@@ -0,0 +1,22 @@
+# Provenance: SVEN train CWE-78 function pair from
+# https://github.com/google/mobly/commit/3862e8ba359040fbdd6e1a6d36e51d07cda8e1ee
+# file mobly/controllers/android_device_lib/adb.py function _exec_cmd
+import logging
+import subprocess
+
+
+class AdbError(Exception):
+    def __init__(self, **kwargs):
+        super().__init__(kwargs)
+
+
+class Adb:
+    def _exec_cmd(self, cmd):
+        """Executes adb commands in a new shell."""
+        proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
+        (out, err) = proc.communicate()
+        ret = proc.returncode
+        logging.debug("cmd: %s, stdout: %s, stderr: %s, ret: %s", cmd, out, err, ret)
+        if ret == 0:
+            return out
+        raise AdbError(cmd=cmd, stdout=out, stderr=err, ret_code=ret)