Add SQLi MVP validation gate and manual QA checklist

[blondres04]

Type: Narrow MVP

Decision

The first MVP is accepted only when one person can manually verify one excellent SQL injection path: an approved CWE-89 finding reaches evidence-backed TRUE_POSITIVE, and a rejected CWE-89 finding stops without PoC generation or detonation.

What To Build

Add a documented SQLi MVP validation gate/checklist that exercises the bundled vulnerable Flask app and produces JSON + Markdown reports suitable for manual review.

Acceptance Criteria

• The validation path runs against test_repos/vulnerable-flask-app or a clearly documented SQLi fixture derived from it.
• Semgrep JSON includes at least one CWE-89 finding for the SQLi path.
• One approved SQLi finding reaches TRUE_POSITIVE.
• The TRUE_POSITIVE has exit-code evidence plus at least one Tier-2 corroborating evidence item.
• One rejected SQLi case reaches REJECTED and does not generate or detonate a PoC.
• JSON and Markdown reports are generated and manually understandable.
• The gate confirms non-CWE-89 findings are not scored or detonated by default.
• README/responsible-use wording does not claim CWE-78, CWE-434, or SARIF-gated MVP support.
• The checklist is concise enough for one person to run before a demo or release-readiness decision.

Deferred

• CWE-78 fixture gate.
• CWE-434 fixture gate.
• SARIF release gate.
• Broad degraded-path matrix beyond the rejected SQLi case and existing critical safety checks.

[blondres04]

Implemented in PR #69: #69

Status:

• Branch pushed: codex/sqli-only-mvp
• Non-Docker verification passed: pytest -m "not integration" (209 passed, 10 deselected), strict mypy, Ruff format check, Ruff lint
• Docker/manual QA is documented in shield-claw/docs/sqli-mvp-validation-checklist.md and remains to be run before release/demo acceptance because Docker Desktop was not running locally
• This issue is linked with Closes #... in PR Narrow ShieldClaw to SQLi-only MVP #69 and should auto-close when that PR merges