feat(sn60): add ultrahighsuper-20260708-01 bitsec miner submission

[ultrahighsuper]

Submission: sn60__bitsec / miner

Single self-contained bundle under submissions/sn60__bitsec/miner/ultrahighsuper-20260708-01/. No files outside the submission are touched.

Approach — category-guided triage + function-validated deep audit

Built for the per-problem budget (3 model calls / 24k output tokens):

1. Risk-ranked discovery — parses the project's own contracts (skips test/mock/example/dependency dirs), extracts contract & function names and a per-file risk profile, and spends the budget on the highest-risk files.
2. Taxonomy-guided triage (1 call) — ranks the riskiest files against the SN60 vulnerability taxonomy and surfaces obvious findings.
3. Deep audit (≤2 calls) — reads the top files in full, line-numbered, and returns concrete high/critical findings as JSON. reasoning.exclude keeps reasoning out of the output budget; calls stop on HTTP 429.
4. Function-validated normalization — every finding must map to a real parsed file+function, severity must be high/critical, and the description is rebuilt into a self-contained explanation (mechanism + impact). Findings are deduped and capped so precision (the tie-breaker) stays high.

The report is non-empty by construction: if inference is unavailable, a small set of conservative pattern findings is returned instead of an empty no-op.

Validation

kata submission validate → valid. Passes static screening (incl. the no-op-agent check), bundle static policy (no forbidden env/provider/secret tokens, no sampling overrides, no benchmark-leak tokens), and the runtime screening-report shape check (severity, description length, source-location hint). Self-contained agent.py within file/size limits.