feat(m3-datasets): source harder security items (diverse CWEs + near-miss safe variants) and harder routing items (NONE cases + close distractors), recalibrate both pools at K_TRIALS=5

Security-adversarial: rebuilt pool with 25 diverse-CWE target items (CWE-362/400/310/200/399/189 etc., not just CWE-787/119) + 10 authored near-miss safe variants (look vulnerable but are safe, penalize FPR) + 35 GLM distractors. Baseline dropped from 83.2% to 64.8% — now in [0.40,0.70] band. Prior ceiling exemption removed.

Routing-abstention: rebuilt pool with 24 hardest borderline selfaware items + 12 authored NONE/unanswerable cases (subtle missing context) + 10 authored close-distractor items (look unanswerable but have factual answers, and vice versa) + socratic/cynefin items. Baseline improved from 88% to 84% — still ceiling. Honest CEILING-NEEDS-HARDER-DATA note recorded per Invariant #4.

Both pools recalibrated at n=25, K_TRIALS=5, CONC=4, solver=claude-sonnet-4-6. Decisive splits re-frozen AFTER calibration. External HF data confirmed gitignored/unstaged.