feat(plane): increment manifests for the 46-candidate validation run (task 7)

Model deepseek-flash (declared provider extension, endpoint prices in
parameters, secretKey naming the DEEPSEEK_API_KEY secret), digest-pinned
Task templates repo-facts / verify / agree, and a generator
(plane/generate.py, `ousast plane workspaces --validation-set ...`) that
emits per case the vulnerable-pin Workspace, a files-only inputs Workspace
(recorded candidates after the recorded triage, declared sites, triage),
per-case Tasks and one Run validation-46: facts -> verify a, verify b ->
agree for the 15 cases, 46 candidates (43 kept), budgets 1.5x the recorded
per-pass share. A Run entry cannot add a binding or env, and Run.inputs
names only task artifacts, so the case is fixed by per-case Tasks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

plane/models/deepseek-flash.yaml

@@ -0,0 +1,22 @@
+# The chat model of the first increment (ai-service-plane Req 1.1, 1.4, 7.1). `deepseek` is not an ax provider;
+# the annotation declares the extension instead of hiding it in another field. `secretKey` names the Kubernetes
+# Secret and key that hold DEEPSEEK_API_KEY, the variable `tool_hunter.resolve_hunter_client()` reads; the key
+# itself is never in a manifest. Prices are `openultrasast.model.endpoint`'s for `deepseek-flash` (USD per million
+# tokens); the verify task's meter reads them from OUSAST_MODEL_PARAMS with `budget.prices_from`.
+apiVersion: ax.io/v1alpha1
+kind: Model
+metadata:
+  name: deepseek-flash
+  atespace: default
+  annotations:
+    openultrasast.io/provider-extension: "true"
+spec:
+  provider: deepseek
+  model: deepseek-flash
+  secretKey:
+    name: deepseek
+    key: DEEPSEEK_API_KEY
+  parameters:
+    cache_hit_per_m: 0.014
+    input_per_m: 0.44
+    output_per_m: 1.32