feat(prover): access-control prover, delivery A: path records, Stapler and Jetty entries, Java operation rows, the prover and its scoring arm

Codex delivery under spec access-control-prover. `semantic/obligations/paths.py` builds entry-to-function path
records from the cached caller index; `mapping.py` names Stapler web methods and Jetty handlers as entries;
`check_obligations` gains the opt-in premise `assume_entries_protected` with the label `unguarded_path`;
`hunt/prover.py` proves a change with no model call and states its coverage; `benchmarks/valid/prover_arm.py`
scores it with the valid-benchmark metrics. Two fixes after the first smoke run: a product file git holds empty
is read, not unread (four changes failed on `__init__.py` and empty assets), and absent-input reasons are
counted by name.

Smoke on the 23 fix changes of the training pool: 7 pushes caught (30 percent, Wilson 16 to 51), 28 of 93
locations, precision 7 of 8 flagged, no instrument failure; three changes over the 120 second bound. Twelve of
the 17 Jenkins fixes reach the fixed method but check no operation because the method is the operation;
the spec now carries handler-named operations for delivery B.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

.kiro/specs/access-control-prover/requirements.md

@@ -82,6 +82,11 @@ so that a guarded route is not reported because its handler body shows no check.
    overrides `get_current_user` and checks it before the operation, the prover shall treat that as a path guard.
 6. Where a declared policy marks a route public, the prover shall suppress `path_guard` findings for it and
    keep `ownership_check` findings, as the checker already does.
+8. Where a framework's security model makes the web method itself the protected operation (Jenkins form
+   validation and list-filling methods `doCheck*`, `doFill*Items`, `doTest*`, `doValidate*`, `doVerify*`, which
+   Jenkins requires to check a permission; Tornado handler methods; a Remix action), the facts shall be able to
+   name the obligation by handler name pattern and framework, and the prover shall apply such an operation only
+   to functions the mapper recognised as entries of that framework, at the method's declaration line.
 7. The prover shall write every enforcement fact as closed data in the obligation facts files, with the header
    naming the clones and references checked, and shall never add a name that does not occur in the checked code
    or the framework's documentation.