feat(corpus-seeded-mechanisms): variant findings in MAP, sandbox-eligible, counted in the manifest

Task 2.3 (Req 3.4, 3.5, 3.6, 6.2).

- [variants] enabled / max_mechanisms config; MAP runs variant search
  after the overlay in standard and deep scans only, appends the variant
  findings, rewrites overlay.json with merged ids, and the manifest
  records mechanisms_searched, files_searched, findings and
  merged_into_overlay.
- REGRESS: variant findings join the candidate list after the promotions
  as zero-score hotspots, under the existing safety check and cap.
- Spec notes for group 2 and the design synced (variant_search.py,
  seed.py, derive_shape signature).

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/config.py

@@ -128,6 +128,13 @@ class RegressConfig:
     images: tuple[tuple[str, str], ...] = ()
 
 
+@dataclass(frozen=True)
+class VariantsConfig:
+    # corpus-seeded-mechanisms: structural variant search in MAP (standard/deep only).
+    enabled: bool = True
+    max_mechanisms: int = 500
+
+
 @dataclass(frozen=True)
 class ResolvedConfig:
     models: ModelConfig = ModelConfig()
@@ -143,6 +150,7 @@ class ResolvedConfig:
     hardening: HardeningConfig = HardeningConfig()
     complexity: ComplexityConfig = ComplexityConfig()
     regress: RegressConfig = RegressConfig()
+    variants: VariantsConfig = VariantsConfig()
     runs_dir: str = ".openultrasast/runs"
 
 
@@ -167,6 +175,7 @@ def load_config(config_path: Path | None = None) -> ResolvedConfig:
         hardening=_load_hardening(data.get("hardening", {})),
         complexity=_load_complexity(data.get("complexity", {})),
         regress=_load_regress(data.get("regress", {})),
+        variants=_load_variants(data.get("variants", {})),
         runs_dir=os.environ.get("OPENULTRASAST_RUNS_DIR", ".openultrasast/runs"),
     )
 
@@ -328,3 +337,11 @@ def _float_value(value: object, default: float) -> float:
         except ValueError:
             return default
     return default
+
+
+def _load_variants(value: object) -> VariantsConfig:
+    data = _section(value)
+    return VariantsConfig(
+        enabled=bool(data.get("enabled", True)),
+        max_mechanisms=int(str(data.get("max_mechanisms", 500))),
+    )