feat(pair-corpus-honesty): add vibe-py, vfc-js and agent-vfc slices with mechanism vocabulary

Tasks 1.1, 5.1, 5.2, 5.4 and the data half of 5.3.

- mechanisms.toml: closed vocabulary v1 (20 ids) every expected row cites.
- vibe-py: 35 Real-Vuln-Benchmark pairs (Apache-2.0), human provenance only
  because the LLM-generated repositories carry no license (escalated).
- vfc-js: 17 Node fix-commit pairs harvested upstream (MIT/Apache-2.0),
  SecBench.js itself is not vendored (no license); sinks derived on 13/17.
- agent-vfc: 29 agent-trailer fixes as catalog-candidates.toml plus
  REVIEW.md; the loaded catalog stays empty until a human reviews them.
- datasets.toml and README document every slice and its review status.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

benchmarks/pairs/vfc-js/serve-here-js-1-1-0/fixed.js

@@ -0,0 +1,29 @@
+// Provenance: ChristoPy/serve-here.js  (fixed).
+// repo: ChristoPy/serve-here.js
+// commit: cefb51d03290b6a88dd13143ab2de31b8cf57c39
+// parent: ad077637bf7a9fe0dee3262f011aed19a45ce92c
+// commit_url: https://github.com/ChristoPy/serve-here.js/commit/cefb51d03290b6a88dd13143ab2de31b8cf57c39
+// cve: CVE-2019-5444
+// license: MIT
+// function: ConfigureFilePath
+// relpath: source/response.js
+// provenance: human
+// mechanism: path_join_user_input
+// upstream_start: 14
+
+module.exports.ConfigureFilePath = (Options, FilePath) => {
+
+	const Slash = FilePath.split ("")[FilePath.split ("").length - 1] === "/";
+
+	if (FilePath === "/") {
+		return `${Options.RootFolder}/${Options.IndexFile}`;
+	} else {
+		const IsMalicious = HasMaliciousPath(Options, FilePath);
+
+		if (IsMalicious) {
+			return null;
+		} else {
+			return (Slash ? `${Options.RootFolder}${FilePath.slice (0, -1)}` : `${Options.RootFolder}${FilePath}`);
+		}
+	}
+}

benchmarks/pairs/vfc-js/serve-here-js-1-1-0/vuln.js

@@ -0,0 +1,23 @@
+// Provenance: ChristoPy/serve-here.js  (vuln).
+// repo: ChristoPy/serve-here.js
+// commit: ad077637bf7a9fe0dee3262f011aed19a45ce92c
+// parent: ad077637bf7a9fe0dee3262f011aed19a45ce92c
+// commit_url: https://github.com/ChristoPy/serve-here.js/commit/cefb51d03290b6a88dd13143ab2de31b8cf57c39
+// cve: CVE-2019-5444
+// license: MIT
+// function: ConfigureFilePath
+// relpath: source/response.js
+// provenance: human
+// mechanism: path_join_user_input
+// upstream_start: 5
+
+module.exports.ConfigureFilePath = (Options, FilePath) => {
+
+	const Slash = FilePath.split ("")[FilePath.split ("").length - 1] === "/";
+
+	switch (FilePath) {
+
+		case "/": return `${Options.RootFolder}/${Options.IndexFile}`;
+		default: return (Slash ? `${Options.RootFolder}${FilePath.slice (0, -1)}` : `${Options.RootFolder}${FilePath}`);
+	}
+}