feat(constrained-detector): the ceiling, measured offline across every slice

Group 1 complete. Tasks 1.2 and 1.3: `candidates.ceiling`, `ousast learning
candidates`, and the stop-or-go reading. No model is called anywhere in this
group, so the condition that could have ended the feature was reachable for
free.

Verdict: go.

  agent-vfc (deciding)  89.7% ceiling against 44.4% round-zero detection
  vfc (deciding)        84.7%, baseline still running, non-gating
  vfc-js (deciding)     52.9% -- see below
  github (deciding)    100.0%
  vibe-py (development)100.0% against 83.3%

The margin is largest on agent-vfc, which is the slice the tool is actually
for.

The measurement forced a shape correction before the detector existed.
config_secrets first read 63.6% with a bind-and-literal shape, because a
permissive default is as often an argument to a call -- cors({origin: '*'}),
app.use(session({secure: false})) -- as it is a binding. Adding call sites to
that family's shape took it to 100% and recovered four agent-vfc rows.

Carry-forward, and not this feature's to fix: vfc-js sits at 52.9% because
eight of seventeen rows label a function the JavaScript CST names `<anon>` --
`module.exports.publish = function () {}` and its relatives. That is a
function-naming gap, it caps the existing hunter on that slice exactly as
much, and it is the same class as the `_declarator_start` defects found in
learning-harness task 4.1.

The ruleset arm of `ceiling` is kept so the 12.1% that rejected it stays a
measurement rather than a remembered number.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

tests/test_pair_registration_context.py

@@ -21,6 +21,7 @@ from openultrasast.learning.families import load_families
 from openultrasast.mapping import analyze_entry_points
 from openultrasast.pairs import DEFAULT_CATALOG, load_pair_catalog, select_vendored
 from openultrasast.preprocess import preprocess_repository
+from openultrasast.semantic.extra import has_semantic_extra
 
 LIB = Path("benchmarks/pairs/harvest.py")
 FAMILIES = Path("src/openultrasast/ruleset/families.toml")
@@ -444,6 +445,8 @@ def test_a_javascript_excerpt_never_starts_in_the_middle_of_an_import() -> None:
     assert "from '@overleaf" not in excerpt
 
 
+@pytest.mark.semantic
+@pytest.mark.skipif(not has_semantic_extra(), reason="parsing JavaScript needs the tree-sitter grammar")
 def test_the_overleaf_excerpt_parses_on_both_sides() -> None:
     from openultrasast.semantic.ir import parse_file