bench(reviewer-eval): api-security batch 1 — corpus 14 -> 30 (+8 golds, +8 pairs) (#299)

First MINED rows for any domain suite: 8 outcome=fixed CodeRabbit security
findings adapted into anonymized api-security golds (one checklist slug each,
caseId/sourcePr/outcomeEvidence/scopeConfirmed stamped) + a fixed-variant
minimal-pair decoy per gold. Corpus 14 -> 30 (16 gold / 14 decoy); the
holdout floor flipped 2 decoys to holdout and said so. bench validate green;
tracker views re-rendered.

Note: earlier session numbers citing a 25-row api-security corpus were read
from a dirty working tree — committed truth was 14 rows, making this batch a
2.1x growth of the suite.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: norvalbv