fix(pair-corpus-honesty): re-harvest curl/OpenSSL excerpts, restore Juliet fixtures

Tasks 3.3 and 4.1.

- vfc curl and openssl-cve-2021-3449 excerpts re-harvested through the
  shared library: whole functions with upstream_start headers, the
  vendored key redacted code-safely, no truncated bodies.
- vfc/recipes.toml carries mode, fix_path and function anchors;
  training/manifest.jsonl regenerated.
- Juliet CWE-121 strcpy pair gets its buffer declarations back so the
  vulnerable side is a real overflow again.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

benchmarks/pairs/sast/juliet-c/cwe121-strcpy-fixed.c

@@ -1,10 +1,18 @@
-/* Juliet CWE-121 goodG2B still copies with strcpy (larger buffer, same sink).
- * Regex SAST is expected to keep firing — that is the Juliet goodG2B trap.
- * Upstream: CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01.c
- */
+/* Juliet 1.3 CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01 (CC0).
+ * goodG2B(): same strcpy; data points at the 11-byte buffer, so the copy fits. */
 #include <string.h>
+#define SRC_STRING "AAAAAAAAAA"
 
-void CWE121_char_declare_cpy_01_goodG2B(char *data, char *source)
+static void CWE121_char_declare_cpy_01_goodG2B()
 {
-    strcpy(data, source);
+    char * data;
+    char dataBadBuffer[10];
+    char dataGoodBuffer[10+1];
+    /* FIX: Set a pointer to a buffer that leaves room for a NULL terminator */
+    data = dataGoodBuffer;
+    data[0] = '\0'; /* null terminate */
+    {
+        char source[10+1] = SRC_STRING;
+        strcpy(data, source);
+    }
 }

benchmarks/pairs/sast/juliet-c/cwe121-strcpy-vuln.c

@@ -1,11 +1,18 @@
-/* Juliet CWE-121 flow variant 01 — bad sink only.
- * Upstream: CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01.c
- * https://github.com/arichardson/juliet-test-suite-c (NIST Juliet 1.3, CC0)
- */
+/* Juliet 1.3 CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01 (CC0).
+ * bad(): data points at a 10-byte buffer; strcpy writes 11 bytes (10 chars + NUL). */
 #include <string.h>
+#define SRC_STRING "AAAAAAAAAA"
 
-void CWE121_char_declare_cpy_01_bad(char *data, char *source)
+void CWE121_char_declare_cpy_01_bad()
 {
-    /* POTENTIAL FLAW: data may not have enough space to hold source */
-    strcpy(data, source);
+    char * data;
+    char dataBadBuffer[10];
+    char dataGoodBuffer[10+1];
+    /* FLAW: Set a pointer to a buffer that does not leave room for a NULL terminator */
+    data = dataBadBuffer;
+    data[0] = '\0'; /* null terminate */
+    {
+        char source[10+1] = SRC_STRING;
+        strcpy(data, source);
+    }
 }