feat(plane): scoring parity with the reference -- sites, ranges, triage cost

agree matched declared sites through benchmarks/independent/evaluate.py,
which the runner image does not carry, so site matching would have been
"not assessed". The generator now resolves the fix's old-side ranges
(evaluate.hunks, line for line) into case.json, with the declared sites in
the set and the reference's cost, and agree.matches_declared reproduces
matches_v2; a parity test runs both over the recorded outputs of the 15
validation cases (200 probes, identical verdicts) and agree on those outputs
returns the reference's 16 of 20 and $0.022.

agree reports cost_per_candidate (plane spend) and
cost_per_candidate_with_recorded_triage; Requirement 6.2 is judged on the
latter (design.md). --runner-image re-pins the templates from ops/ax/up.sh's
pin file; the committed manifests are regenerated at the current digest.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

plane/workspaces/pgadmin-maintenance-sqli-inputs.yaml

@@ -1,4 +1,4 @@
-# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --run validation-46`; do not edit, regenerate.
+# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set ~/ousast-results/independent-v2-sets/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --runner-image ~/.cache/ousast/ax-src/runner-image`; do not edit, regenerate.
 apiVersion: ax.io/v1alpha1
 kind: Workspace
 metadata:
@@ -17,7 +17,8 @@ spec:
       \n },\n {\n  \"function\": \"run_job\",\n  \"line\": 746,\n  \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\n },\n {\n  \"function\": \"create\",\n  \"line\": 365,\n  \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\n },\n {\n  \"function\": \"msql\",\n  \"line\": 454,\n  \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\n },\n {\n  \"function\": \"sql\",\n  \"line\": 492,\n  \"path\": \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_schedules/__init__.py\"\n },\n {\n  \"function\": \"msql\",\n  \"line\": 623,\n  \"path\": \"web/pgadmin/browser/server_groups/servers/databases/event_triggers/__init__.py\"\n },\n {\n  \"function\": \"create\",\n  \"line\": 290,\n  \"path\": \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\"\n },\n {\n  \"function\"\
       : \"delete\",\n  \"line\": 394,\n  \"path\": \"web/pgadmin/browser/server_groups/servers/databases/extensions/__init__.py\"\n },\n {\n  \"function\": \"get_extension_details\",\n  \"line\": 30,\n  \"path\": \"web/pgadmin/browser/server_groups/servers/databases/extensions/utils.py\"\n },\n {\n  \"function\": \"delete\",\n  \"line\": 601,\n  \"path\": \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/__init__.py\"\n },\n {\n  \"function\": \"create\",\n  \"line\": 464,\n  \"path\": \"web/pgadmin/browser/server_groups/servers/databases/foreign_data_wrappers/foreign_servers/__init__.py\"\n },\n {\n  \"function\": \"create_maintenance_job\",\n  \"line\": 222,\n  \"path\": \"web/pgadmin/tools/maintenance/__init__.py\"\n }\n]\n"
   - path: case.json
-    content: "{\n \"family\": \"injection\",\n \"id\": \"pgadmin-maintenance-sqli\",\n \"sites\": [\n  \"web/pgadmin/tools/maintenance/__init__.py::create_maintenance_job\"\n ]\n}\n"
+    content: "{\n \"cost\": {\n  \"candidates_before_triage\": 27,\n  \"recorded_triage_basis\": \"derived per file from the batched-check scans: recorded usd (triage + hunts) minus the recorded hunt usage priced at deepseek-flash list prices; the triage call's own usage was not recorded\",\n  \"recorded_triage_usd\": 0.048665,\n  \"recorded_usd\": 0.3949\n },\n \"family\": \"injection\",\n \"id\": \"pgadmin-maintenance-sqli\",\n \"ranges\": {\n  \"web/pgadmin/tools/maintenance/__init__.py\": [\n   [\n    12,\n    12\n   ],\n   [\n    150,\n    150\n   ],\n   [\n    171,\n    171\n   ]\n  ],\n  \"web/pgadmin/tools/maintenance/templates/maintenance/sql/command.sql\": [\n   [\n    16,\n    16\n   ]\n  ],\n  \"web/pgadmin/tools/maintenance/tests/test_maintenance_create_job_unit_test.py\": [\n   [\n    562,\n    562\n   ],\n   [\n    647,\n    647\n   ],\n   [\n    714,\n    714\n   ],\n   [\n    0,\n    0\n   ]\n  ]\n },\n \"ranges_basis\": \"git diff -U0 <vulnerable> <fixed>, old side: benchmarks/independent/evaluate.hunks(case,\
+      \ 'old')\",\n \"sites\": [\n  \"web/pgadmin/tools/maintenance/__init__.py::create_maintenance_job\"\n ],\n \"sites_in_set\": [\n  \"web/pgadmin/tools/maintenance/__init__.py::create_maintenance_job\"\n ]\n}\n"
   - path: triage.json
     content: "{\n \"candidates\": [\n  [\n   \"web/pgadmin/authenticate/ldap.py\",\n   \"login\",\n   169\n  ],\n  [\n   \"web/pgadmin/authenticate/ldap.py\",\n   \"search_ldap_user\",\n   288\n  ],\n  [\n   \"web/pgadmin/browser/server_groups/servers/__init__.py\",\n   \"create_restore_point\",\n   1881\n  ],\n  [\n   \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n   \"_check_rename_db_or_change_table_space\",\n   808\n  ],\n  [\n   \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n   \"_fetch_db_details\",\n   831\n  ],\n  [\n   \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n   \"create\",\n   761\n  ],\n  [\n   \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n   \"delete\",\n   1061\n  ],\n  [\n   \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n   \"get_ctypes\",\n   651\n  ],\n  [\n   \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n   \"get_encodings\",\n\
       \   623\n  ],\n  [\n   \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n   \"get_sql\",\n   1107\n  ],\n  [\n   \"web/pgadmin/browser/server_groups/servers/databases/__init__.py\",\n   \"update\",\n   936\n  ],\n  [\n   \"web/pgadmin/browser/server_groups/servers/databases/casts/__init__.py\",\n   \"delete\",\n   546\n  ],\n  [\n   \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n   \"_fetch_properties\",\n   362\n  ],\n  [\n   \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n   \"create\",\n   412\n  ],\n  [\n   \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n   \"enable_disable\",\n   662\n  ],\n  [\n   \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\",\n   \"get_job_args_value\",\n   779\n  ],\n  [\n   \"web/pgadmin/browser/server_groups/servers/databases/dbms_job_scheduler/dbms_jobs/__init__.py\"\