Add automated code location repair tool

[March-77]

Summary

• add a conservative Python location repair tool for entry_point, critical_operation, and trace[*] nodes
• support whitespace-tolerant, multi-line matching with nearby, same-file, and repository-wide unique-match strategies
• cache partial clones and lazily create commit worktrees only for repository-wide searches
• emit complete entries.fixed.jsonl, fix_diff.csv, and needs_human.csv deliverables
• add focused unit tests and usage/limitations documentation

Why

Some VulnGym annotations have code snippets that do not align with their recorded file or line. The tool repairs only uniquely identifiable locations and sends ambiguous, missing, invalid, or unavailable cases to an auditable human-review queue rather than guessing.

Generated results

• 408 JSONL rows preserved
• 101 unique-match repairs (nearby: 99, same_file: 2)
• 85 nodes sent to needs_human.csv
• descriptions retain their semantics; explicit old line references are synchronized by the current tool

Some human-review rows record upstream repository fetch failures encountered during the full cold-cache run. They are intentionally not auto-modified.

Validation

• python -m unittest discover -s tests -v (9 tests pass)
• python -m py_compile tools/fix_code_locations.py
• git diff --check
• schema smoke check over all 408 output rows, including ordering, commit format, required node keys, verify values, and line/range constraints
• focused verify=0 offline run completed in approximately 4 seconds with a warm cache

Closes #4