test(integration): add benign hard negatives to the adversarial corpus

[VibhorGautam]

adds 16 benign hard negatives (ap-109 to ap-124) that Kavishka put together while reproducing the detection numbers. these measure the false positive side that the corpus never covered, we only ever counted catch rate

split into 2 groups, same convention the corpus already uses:

• ap-109 to ap-117 pass today and pin current behaviour. 4 of them (ap-114 to ap-117) are canaries, each carries exactly 1 of the chars a later shellMetachars change might add (?, bare &, [], *). they pass now and go red the moment that char lands, which is the point, it catches the regression before it ships instead of after
• ap-118 to ap-124 are real false positives, tracked as tolerant gap probes (expected = current wrong verdict, desired = ALLOW) exactly like the attack-side gaps. e.g. ap-120, the allowlisted calculator getting BLOCKed on (5 > 3) && (2 < 4) because checkToolDangerousParams flattens all params into a single string and substring-scans with no per-tool context

corpus only, no code or policy changes. full integration suite green locally with -count=1, 9 strict cases pass, 7 gaps register as open. authored by Kavishka, landed verbatim