spec(pre-push-safety-net): pre-register the hunter experiment on population v2

This is the deciding experiment of the strategy review, fixed before any v2 pin is
hunted.
- Hunter: the unchanged tool hunter (default prompt, tools and 4 steps) on
  deepseek-flash.
- Scope: the ranker's top 20 regions for the case family, in four hunts. The model
  never sees the fix diff or the declared sites.
- Families: a fixed keyword table maps the model's family to the protocol's three.
- Scoring: exactly protocol v2's scorer.
- Cost: a hard $10 ceiling.

hunt.py runs it and scores it (--score). A pilot on a v1 development case
(mongo-express) found the vulnerability at lib/bson.js:60, at $0.031 per pin,
alongside a lot of speculative noise.

Transport fix found by the pilot: the DeepSeek endpoint the hunter builds was
unpriced, so the cost meter read $0.00 for any number of calls. It is now priced.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

tests/test_model_endpoint.py

@@ -244,5 +244,7 @@ def test_the_hunter_reaches_deepseek_when_its_key_is_set(monkeypatch) -> None:
     monkeypatch.setenv("OPENROUTER_API_KEY", "embeddings-key")
     client = tool_hunter.resolve_hunter_client()
     assert isinstance(client, DeepSeekChatClient), type(client)
+    # Priced: a budget that reads $0.00 for any number of calls is not a budget.
+    assert client.endpoint is not None and client.endpoint.prices is not None
     monkeypatch.delenv("DEEPSEEK_API_KEY")
     assert not isinstance(tool_hunter.resolve_hunter_client(), DeepSeekChatClient)