feat(pair-corpus-honesty): score non-vendored pointer pairs through a local cache

Task 8.3 (Req 10.1-10.5).

- pairs.py: catalog rows with vendored = false carry their harvest recipe
  and no excerpts; evaluate_catalog harvests them into
  OPENULTRASAST_PAIR_CACHE (default ~/.cache/openultrasast/pairs) only
  when `pairs --pointers` or OPENULTRASAST_PAIRS_NETWORK=1 allows the
  network, otherwise records pointer_pair_skipped (a failed fetch is
  pointer_pair_fetch_failed with detail); a warm cache never scores
  without the switch. select_vendored for tests and gates.
- harvest.py: materialize_pointer harvests into the cache without the
  license requirement (nothing is redistributed); redaction applies.
- catalog_gen.py: emits pointer rows with recipe fields; training
  manifests skip them.
- pair_gate and improve/evolve.evaluate_profiles score vendored pairs
  only; cli `pairs --pointers`; .gitignore covers the cache path.
- tests: loader, skip/degradation, cache hit, fetch failure, warm cache
  with network off, profile gate exclusion, harvest and generator paths;
  conftest keeps every test offline whatever the shell exports.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

benchmarks/pairs/README.md

@@ -67,6 +67,18 @@ Defaults per slice: local `reviewed`, vibe-py `seeded`, sast/vfc/vfc-js/github
 `advisory`, agent-vfc `title`. `pairs --json` reports `per_tier`; `evolve.evaluate_profiles` scores only `seeded`
 and `reviewed` pairs, so `advisory` and `title` pairs never gate the improve loop (task 8.2).
 
+## Pointer pairs (not vendored)
+
+A row with `vendored = false` carries its harvest recipe (`repo`, `parent`, `commit`,
+`path`, `mode`, `line`/`fix_path`/`fix_line`, ...) and no excerpt files (Req 10). The
+repository never redistributes that code: `pairs --pointers` (or
+`OPENULTRASAST_PAIRS_NETWORK=1`) harvests both sides into
+`OPENULTRASAST_PAIR_CACHE` (default `~/.cache/openultrasast/pairs/<slice>/<name>/`,
+git-ignored) and scores them exactly like a vendored pair; without network the pair is
+skipped with a `pointer_pair_skipped` degradation and a failed fetch is
+`pointer_pair_fetch_failed`, never an error. The default `pytest` run and every gate
+score vendored pairs only (`select_vendored`); the pointer run is the nightly command.
+
 ## Labels, profiles, and mechanisms
 
 Every `[[pair.expected]]` row names a `mechanism` from the closed vocabulary in