feat(pair-corpus-honesty): add vibe-py, vfc-js and agent-vfc slices with mechanism vocabulary

Tasks 1.1, 5.1, 5.2, 5.4 and the data half of 5.3.

- mechanisms.toml: closed vocabulary v1 (20 ids) every expected row cites.
- vibe-py: 35 Real-Vuln-Benchmark pairs (Apache-2.0), human provenance only
  because the LLM-generated repositories carry no license (escalated).
- vfc-js: 17 Node fix-commit pairs harvested upstream (MIT/Apache-2.0),
  SecBench.js itself is not vendored (no license); sinks derived on 13/17.
- agent-vfc: 29 agent-trailer fixes as catalog-candidates.toml plus
  REVIEW.md; the loaded catalog stays empty until a human reviews them.
- datasets.toml and README document every slice and its review status.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

benchmarks/pairs/vibe-py/vfapi-main-put-user/fixed.py

@@ -0,0 +1,15 @@
+# Provenance: naryal2580/vfapi put_user (fixed).
+# repo: naryal2580/vfapi
+# commit: f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3
+# parent: f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3
+# commit_url: https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L188
+# cve: 
+# license: MIT
+# function: put_user
+# relpath: main.py
+# provenance: human
+# mechanism: source_reaches_sink
+# upstream_start: 219
+
+async def nosql_return_users_from_username(username: str):
+    return get_nosql_users({'username': username})

benchmarks/pairs/vibe-py/vfapi-main-put-user/vuln.py

@@ -0,0 +1,44 @@
+# Provenance: naryal2580/vfapi put_user (vuln).
+# repo: naryal2580/vfapi
+# commit: f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3
+# parent: f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3
+# commit_url: https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L188
+# cve: 
+# license: MIT
+# function: put_user
+# relpath: main.py
+# provenance: human
+# mechanism: source_reaches_sink
+# upstream_start: 186
+
+async def put_user(user: User):
+    user.password = md5(user.password.encode()).hexdigest()
+    query = f'''
+INSERT INTO users (
+                    name,
+                    username,
+                    password,
+                    address,
+                    email,
+                    contact
+                ) VALUES ( 
+                            "{user.name}",
+                            "{user.username}",
+                            "{user.password}",
+                            "{user.address}",
+                            "{user.email}",
+                            "{user.contact}"
+                            );
+'''[1:-1]
+    await run_sql_query(query, commit=True)
+    _id = await run_sql_query('SELECT id from users ORDER BY ROWID DESC limit 1;')
+    db_client.vfapi.users.insert_one({
+        'id': _id,
+        'name': user.name,
+        'username': user.username,
+        'password': user.password,
+        'address': user.address,
+        'email': user.email,
+        'contact': user.contact
+        })
+    return {'resp': 'done'}