feat(propose-adjudicate-prove): overlay adjudicates inventory before prove

Regex inventory stays the proposer. MAP attaches promote/demote/unadjudicated/coverage
from intra-file taint (tree-sitter when a grammar parses, Python ast as last resort).
Deep sandboxes promotions only, ordered by the existing heuristic ranker plus optional
OpenRouter mechanism recall. The SAST pair slice scores overlay outcomes; the stage-1
detection gate and local pair gate stay inventory-only.

benchmarks/pairs/sast/juliet-java/cwe78-exec-fixed.java

@@ -0,0 +1,12 @@
+/* Juliet CWE-78 goodG2B — hardcoded source, same Runtime.exec sink.
+ * Regex SAST is expected to keep firing — Juliet goodG2B trap.
+ * Upstream: CWE78_OS_Command_Injection__console_readLine_01.java
+ */
+public class CWE78_OS_Command_Injection__console_readLine_01 {
+    public void goodG2B() throws Throwable {
+        String data = "foo";
+        String osCommand = "/bin/ls ";
+        Process process = Runtime.getRuntime().exec(osCommand + data);
+        process.waitFor();
+    }
+}