feat(sn60): corroboration-ranked recall miner (bohdansolovie-20260723-06)

[bohdansolovie]

Summary

• feat(sn60): fix #191 f-string screener break (bohdansolovie-20260723-05) #192 (bohdansolovie-20260723-05) lost at tier 1 (project pass score): 0% vs the king's 5% average. Because the pass tier is decided first, falling behind there ends the comparison — the emit-5 precision profile could not pass any project.
• This challenger returns to a recall-first whole-repo audit (triage map → deep audit → wide second pass → model-free structural probes), which is what sustains a non-zero pass score, and adds two changes aimed at the tiers that actually decide this king:
  • Cross-pass corroboration ranking. Findings are keyed by (file, function, bug-class) and voted across passes; issues multiple passes agree on rank first. Agreement is the best cheap proxy for a real bug, so the top of the report is higher-precision without discarding recall.
  • Localization guard. A finding tied to a real function, or at least a contract actually declared in the resolved file, is "pinned" and emitted first; unpinnable candidates (the usual hallucinations, which also rarely match the grader) only backfill spare budget. This trims false positives to defend the precision / F1 tiers while keeping full recall on the pass tier.
• Emit cap 28 (recall) with the king's robust two-attempt, budgeted transport so slow/failed passes degrade the report instead of adding invalid runs.

Test plan

• python -m py_compile clean; zero f-string literals and an ast.unparse → re-parse roundtrip succeeds (the exact break that made feat(sn60): king-recall transform + emit-5 margin win (bohdansolovie-20260723-04) #191 invalid cannot recur).
• kata submission validate → status valid, screening pass.
• Similarity vs current king 0.63 (below the 0.85 review threshold).
• End-to-end smoke run on a synthetic vulnerable contract returns correctly localized, schema-valid, JSON-serializable findings.
• Chutes inference key sealed (reused approved ciphertext).

Made with Cursor

[carlos4s]

I closed this PR because it did not pass the submission checks.

Reason: PR touches multiple submission directories. Submit exactly one challenger.

Please fix that issue and open a new PR.