feat(tools): add conservative code location repair workflow

[Du-professor]

Closes #4

Summary

This PR adds a conservative, reproducible workflow for repairing stale code
locations in data/entries.jsonl, together with the generated repair and
manual-review artifacts.

Matching and safety policy

For every entry_point, critical_operation, and trace[*] node, the tool
loads the exact repo_url + commit snapshot and checks locations in this fixed
order:

1. the recorded location;
2. a unique match within five lines of the recorded start;
3. a unique match elsewhere in the recorded file;
4. a unique match in the complete repository tree at the pinned commit.

Whitespace and newline differences are normalized. Exact snippets are tried
first; schema-permitted CJK annotator comment suffixes can be projected only
after the exact attempt fails. Multiple matches are never guessed. Missing,
invalid, unavailable, empty, and ambiguous nodes remain unchanged and are
written to needs_human.csv.

When a file or line changes, desc is updated only for explicit, unambiguous
file/line references. If the description cannot be updated safely, the whole
node repair is withheld for manual review. The tool does not modify code,
verify, vulnerability categories, or other non-location fields.

Results

• Input/output entries: 408 / 408 (2,889 code nodes checked)
• Automatic repairs: 20
  • unique match within five lines: 17
  • unique match elsewhere in the recorded file: 3
• Manual-review nodes: 28
  • code absent from the complete pinned repository snapshot: 27
  • code empty after normalization: 1
• Idempotence: 0 new repairs; the rerun reproduced entries.fixed.jsonl byte
  for byte and retained the same 28 review rows

Focused samples:

• entry-00103: repaired trace[1] from 605-614 to 606-614 and
  trace[2] from 146-155 to 146-154; explicit descriptions were updated.
• entry-00185: repaired trace[1] from 75-82 to 76-82; its description
  contained no explicit location and remained unchanged.
• entry-00320: exact locations; no repair or review row.
• entry-00511: exact locations; no repair or review row.

Verification

python -m unittest discover -s tests -v
Ran 20 tests ... OK

Additional checks passed:

• every JSONL line parses independently and the output satisfies SCHEMA.md;
• entry order and all non-target fields are unchanged;
• every fix_diff.csv row maps exactly to one changed node;
• every unresolved node is unchanged and appears in needs_human.csv;
• source-archive cache completion run: 112.48 seconds (bare Git metadata cache
  already populated);
• fully offline warm-cache idempotence run: 112.61 seconds;
• both full runs remained below the ten-minute target.

The .cache/vulngym-location-fixer/ directory, downloaded upstream projects,
Python caches, temporary files, and credentials are not committed.