data: build public-safe hard-negative candidate pools (#420)

[AbdelStark]

Summary

Adds the deterministic public-safe hard-negative candidate-pool generator and the sandbox label-construction path for the RFC-0016 hard downstream benchmark. A pack can now mix a passing reference with plausible wrong candidates (no-action / near-no-action baits + single-point AST mutants) that create real reranking headroom, instead of relying on easy syntax failures. The non-executing generator lives under codelewm/eval; the only code-executing piece (sandbox labeler) lives under codelewm/data, preserving the sandbox import boundary.

Linked Issue

Closes #420.

Spec / RFC Reference

• Spec section: docs/spec/11-llm-world-model-harness.md, docs/spec/06-security.md
• RFC: docs/rfcs/RFC-0016-hard-downstream-reranking-benchmark.md

Public Surface Impact

New Python API:

• codelewm.eval: generate_hard_negative_pool, build_label_construction_report, HardNegativeCandidate, HardNegativePoolError, HARD_NEGATIVE_POOL_SCHEMA_VERSION, LABEL_CONSTRUCTION_REPORT_SCHEMA_VERSION.
• codelewm.data.hard_negative_labeler: label_candidate, label_candidates, build_sandbox_label_construction_report, LabelTestCase, CandidateLabel, HardNegativeLabelerError.

New schema versions (additive): codelewm.hard_negative_pool.v1, codelewm.downstream_label_construction_report.v1, codelewm.hard_negative_labeled_candidate.v1.

New config key (optional, task-level): generated_pool (reference_after_path, seed, pool_size). DownstreamBenchmarkPackResult gains optional label_construction_report_path. No existing field/baseline/schema changed. No new CLI command — eval downstream-pack drives generation when the config sets generated_pool.

Validation

uv run pytest tests/eval/test_hard_downstream_pool.py tests/data/test_hard_negative_labeler.py -q   # 14 passed
uv run pytest tests/eval/test_downstream_pack.py tests/eval/test_downstream_rerank.py tests/eval/test_downstream_schema.py tests/eval/test_hard_downstream_schema.py tests/eval/test_hard_downstream_pack.py tests/security/test_sandbox_import_boundary.py tests/test_imports.py -q   # 34 passed
uv run python -m compileall -q codelewm/eval/hard_negative_pool.py codelewm/data/hard_negative_labeler.py codelewm/eval/downstream_pack.py codelewm/eval/__init__.py
git diff --check

Artifact Impact

A pack with a generated_pool task writes reports/label_construction_report.json (codelewm.downstream_label_construction_report.v1), materializes generated candidate files under tasks/<id>/candidates/, and records label_construction_report in the manifest. Each generated candidate's source carries hard_negative_class, checksum, generator, label_source, and source_license_status.

Deprecations

none

Caveats / Follow-ups

• Mutant candidates are labeled unknown by the deterministic generator (not asserted). The codelewm.data.hard_negative_labeler sandbox path upgrades them to verified pass/fail; feed those labels back into a config for headline runs.
• The bundled generated-pool fixture has one task (and identical token sets at n=1), so it stays claim-blocked; it exercises plumbing, not eligibility.
• Follow-ups: harness: ingest LLM candidate packs into the hard benchmark #421 (LLM candidate ingestion), eval: score hard benchmark baselines and CodeLeWM claim gate #422 (scoring + claim gate), results: publish hard benchmark artifacts and claim audit #423 (publication).