feat(pair-corpus-honesty): score non-vendored pointer pairs through a local cache

Task 8.3 (Req 10.1-10.5).

- pairs.py: catalog rows with vendored = false carry their harvest recipe
  and no excerpts; evaluate_catalog harvests them into
  OPENULTRASAST_PAIR_CACHE (default ~/.cache/openultrasast/pairs) only
  when `pairs --pointers` or OPENULTRASAST_PAIRS_NETWORK=1 allows the
  network, otherwise records pointer_pair_skipped (a failed fetch is
  pointer_pair_fetch_failed with detail); a warm cache never scores
  without the switch. select_vendored for tests and gates.
- harvest.py: materialize_pointer harvests into the cache without the
  license requirement (nothing is redistributed); redaction applies.
- catalog_gen.py: emits pointer rows with recipe fields; training
  manifests skip them.
- pair_gate and improve/evolve.evaluate_profiles score vendored pairs
  only; cli `pairs --pointers`; .gitignore covers the cache path.
- tests: loader, skip/degradation, cache hit, fetch failure, warm cache
  with network off, profile gate exclusion, harvest and generator paths;
  conftest keeps every test offline whatever the shell exports.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/pair_gate.py

@@ -21,6 +21,7 @@ from .pairs import (
     evaluate_catalog,
     load_pair_catalog,
     select_slice,
+    select_vendored,
 )
 
 
@@ -33,7 +34,7 @@ class PairGateVerdict:
 
 def pair_gate(cases: Sequence[PairCase] | None = None) -> PairGateVerdict:
     catalog = tuple(cases) if cases is not None else load_pair_catalog(DEFAULT_CATALOG)
-    local = select_slice(catalog, "local")
+    local = select_vendored(select_slice(catalog, "local"))  # Req 10.4: gates score vendored pairs only
     if not local:
         return PairGateVerdict(passed=False, reasons=("no local pairs in catalog",), result=evaluate_catalog(()))
     result = evaluate_catalog(local)