fix(pair-corpus-honesty): re-harvest curl/OpenSSL excerpts, restore Juliet fixtures

Tasks 3.3 and 4.1.

- vfc curl and openssl-cve-2021-3449 excerpts re-harvested through the
  shared library: whole functions with upstream_start headers, the
  vendored key redacted code-safely, no truncated bodies.
- vfc/recipes.toml carries mode, fix_path and function anchors;
  training/manifest.jsonl regenerated.
- Juliet CWE-121 strcpy pair gets its buffer declarations back so the
  vulnerable side is a real overflow again.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

benchmarks/pairs/vfc/curl-cve-2021-22876/fixed.c

@@ -7,13 +7,10 @@
  * license: curl
  * function: Curl_follow
  * relpath: lib/transfer.c
+ * provenance: human
+ * mechanism: other
  */
 
-* Curl_follow() handles the URL redirect magic. Pass in the 'newurl' string
- * as given by the remote server and set up the new URL to request.
- *
- * This function DOES NOT FREE the given url.
- */
 CURLcode Curl_follow(struct Curl_easy *data,
                      char *newurl,    /* the Location: string */
                      followtype type) /* see transfer.h */

benchmarks/pairs/vfc/curl-cve-2021-22876/vuln.c

@@ -7,13 +7,10 @@
  * license: curl
  * function: Curl_follow
  * relpath: lib/transfer.c
+ * provenance: human
+ * mechanism: other
  */
 
-* Curl_follow() handles the URL redirect magic. Pass in the 'newurl' string
- * as given by the remote server and set up the new URL to request.
- *
- * This function DOES NOT FREE the given url.
- */
 CURLcode Curl_follow(struct Curl_easy *data,
                      char *newurl,    /* the Location: string */
                      followtype type) /* see transfer.h */