feat(propose-adjudicate-prove): overlay adjudicates inventory before prove

Regex inventory stays the proposer. MAP attaches promote/demote/unadjudicated/coverage
from intra-file taint (tree-sitter when a grammar parses, Python ast as last resort).
Deep sandboxes promotions only, ordered by the existing heuristic ranker plus optional
OpenRouter mechanism recall. The SAST pair slice scores overlay outcomes; the stage-1
detection gate and local pair gate stay inventory-only.

src/openultrasast/ruleset/semantic/javascript.toml

@@ -0,0 +1,29 @@
+version = "1"
+language = "javascript"
+
+[[source]]
+id = "req"
+patterns = ["req.query", "req.body", "req.params", "req.cookies", "req.headers", "request.query"]
+
+[[sink]]
+id = "eval"
+cwe = "CWE-95"
+calls = ["eval"]
+rule_ids = ["js-eval"]
+
+[[sink]]
+id = "exec"
+cwe = "CWE-78"
+calls = ["exec", "execSync"]
+rule_ids = ["js-command-exec"]
+
+[[sink]]
+id = "query"
+cwe = "CWE-89"
+calls = ["query", "execute"]
+rule_ids = ["js-sql-injection"]
+
+[[sanitizer]]
+id = "parameterized_query"
+calls = ["query", "execute"]
+parameterized = true