chore(bench): author the full seed suite + uv harness env (#99)

[Connorrmcd6]

Authors the full bench seed suite for milestone 11 (#99) and pins the harness env so the pilot (#100) runs unambiguously.

What changed

Five new scenarios (suite is now 7, spanning the drift archetypes surf check fires on, in both QA and code-edit form, across Python and TypeScript):

Scenario	Lang	Type	Drift archetype
ratelimit-window-code	py	code	comparison flip <→<= (admits N+1)
access-invert-qa	py	QA	allow-list inverted into a block-list
retry-budget-code	py	code	changed constant (attempt cap 3→5)
pagination-ts-code	ts	code	changed constant (page size 50→25)
dropped-await-qa	py	QA	dropped await → fire-and-forget write

Each is sealed by the real surf binary via tools/author.py, so the stale hub genuinely diverges and surf_report.json is authentic surf check --format json output — the C3 context the agent sees is not hand-mocked. Authored so the correct answer is non-obvious from a quick code read (a flipped operator, an inverted membership test, a changed literal, a missing await), or the doc would carry no weight.

Harness hardening so the pilot env is unambiguous:

• grade_code runs python/python3 grader commands under sys.executable, so the hidden checks inherit the harness interpreter (uv venv / plain venv / system) instead of gambling on which python3 is on PATH.
• Adopt uv for the harness env with a committed uv.lock (reproducible spend), and document that Node ≥ 22.18 is required for the TypeScript scenario's node --test type-stripping (no npm install / tsc step).

Verification

Bench is outside the Rust workspace, so a Python/scenario change can't affect the Rust gates — ran them anyway to prove the tree is clean:

• cargo fmt --all --check — clean
• cargo clippy --all-targets --all-features -- -D warnings — clean (no warnings)
• cargo test --all — 34 passed, 0 failed

Bench gates:

• uv run python tools/author.py --all — all 7 scenarios seal; each stale hub genuinely diverges (author.py fails otherwise)
• uv run python -m surface_bench.run --models mock — full offline pipeline runs all 280 cells (7×4×10), no crash
• For every new scenario, a simulated correct answer grades ok/not-misled and a simulated misled (stale-doc) answer grades not-ok/misled — verified for both the python3 and node --test graders under uv run.

Closes #99

🤖 Generated with Claude Code