spec(pre-push-safety-net): freeze the independent population v1 (15.1)

Every reserved case verified with git and file reads only -- nothing
scanned: pins present and ordered, the sink present at the vulnerable pin,
the fix touching the sink (or LearnPress's declared source-side fix site),
and the sink file hashed at both pins (benchmarks/independent/freeze.py,
record freeze-v1.json).

Each case now carries a benign control from its own history, reviewed by
diff. The mechanical keyword filter was not enough: it proposed an access
restriction, a filter check, API-token scopes, a login change and a
TLS-verification option, all rejected; Ultimate Member and alerta got
hand-picked controls (a WPCS reformat; a dependency change with both sides
still vulnerable). The guard test requires a benign pair per case once
frozen.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

tests/test_independent_population.py

@@ -34,6 +34,13 @@ def test_the_reservation_is_well_formed() -> None:
         assert case["vulnerable"] != case["fixed"], case["id"]
         assert case["repo"].startswith("https://github.com/"), case["id"]
         assert case["advisory"] and case["sink"] and case["privilege"], case["id"]
+    if data["status"] == "frozen":
+        # Frozen means every case carries its benign control: a change from the same history, reviewed as not a
+        # security change, whose two sides a correct analyzer must not tell apart.
+        for case in cases:
+            benign = case.get("benign") or {}
+            assert SHA.fullmatch(benign.get("base", "")) and SHA.fullmatch(benign.get("tip", "")), case["id"]
+        assert (POPULATION.parent / data["freeze_record"]).is_file()
     languages = {case["language"] for case in cases}
     assert {"php", "python"} <= languages and languages & {"javascript", "typescript"}