feat(propose-adjudicate-prove): overlay adjudicates inventory before prove

Regex inventory stays the proposer. MAP attaches promote/demote/unadjudicated/coverage
from intra-file taint (tree-sitter when a grammar parses, Python ast as last resort).
Deep sandboxes promotions only, ordered by the existing heuristic ranker plus optional
OpenRouter mechanism recall. The SAST pair slice scores overlay outcomes; the stage-1
detection gate and local pair gate stay inventory-only.

benchmarks/pairs/sast/juliet-c/cwe121-strcpy-vuln.c

@@ -0,0 +1,11 @@
+/* Juliet CWE-121 flow variant 01 — bad sink only.
+ * Upstream: CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01.c
+ * https://github.com/arichardson/juliet-test-suite-c (NIST Juliet 1.3, CC0)
+ */
+#include <string.h>
+
+void CWE121_char_declare_cpy_01_bad(char *data, char *source)
+{
+    /* POTENTIAL FLAW: data may not have enough space to hold source */
+    strcpy(data, source);
+}