feat(data): improve configuration vulnerability annotations for Issue #8

[Sam-Hui-dot]

Summary

This PR improves the annotation semantics for configuration-class and non-taint vulnerabilities in VulnGym.

It updates the four OpenClaw Dockerfile entries covered by Issue #8:

• entry-00241
• entry-00242
• entry-00243
• entry-00244

The annotations now model configuration-state evidence rather than pretending that these samples contain a traditional attacker-controlled taint flow.

Changes

• Updated the canonical data/entries.jsonl.
• Used FROM as the configuration-state entry point for Dockerfiles that inherit the default root user without a later USER directive.
• Selected narrow effective operations for the missing-USER samples:
  • entry-00241: CMD ["bash"]
  • entry-00242: RUN pnpm install --frozen-lockfile
  • entry-00243: the test-image ENTRYPOINT
• Selected the exact NOPASSWD:ALL sudoers rule at line 18 as the critical operation for entry-00244.
• Rebuilt traces as configuration lifecycle evidence: inheritance, declaration, privilege transition, proof of capability, and runtime effect.
• Kept verify=0 because the schema reserves verify=1 for maintainer-confirmed human audit.
• Added reports/config_vuln_annotation.md with reusable annotation rules.
• Added reports/issue-8-config-annotations.diff.csv with field-level before/after changes and reasons.
• Added scripts/apply_issue8_config_annotations.py for reproducible generation and validation.
• Added focused regression tests.

Evidence

• Advisory: GHSA-W7J5-J98M-W679
• Vulnerable commit: c56fb7f353d63d6ea97028ee7d8a97bc4edf21c1
• Upstream remediation commit: 84281abd4bd1c717bb37a2de12694fe203827eee

The validator confirms that:

• All annotated {file, line, code} nodes match the vulnerable OpenClaw commit exactly.
• The three vulnerable Dockerfiles have no USER directive.
• The remediation commit adds USER appuser to those three Dockerfiles.
• entry-00244 is handled separately because it has USER app but grants unrestricted passwordless sudo.

Validation

• 10 focused unit tests passed.
• 20 annotated source occurrences matched exactly.
• 13 unique source nodes were verified.
• 4 Dockerfiles were checked.
• The fix evidence for all 3 missing-USER Dockerfiles passed.
• The dataset remains 408 entries and 184 reports.
• The report-to-entry mapping remains valid.
• The generator is idempotent.
• git diff --check passed.
• No schema changes were introduced.

Scope

This PR changes only the four Issue #8 target entries and the supporting documentation, generator, diff artifact, and tests.

Closes #8