Stage-1 interceptor matching is duplicated between runtime-server and edgebench_judge, and the live copy has zero tests

[reacher-z]

The Stage-1 interceptor decision — the benchmark's deterministic ground truth — exists in two hand-maintained copies:

• src/clawbench/runtime/runtime-server/server.py:173-185 (_const_fields_match) and :449-477 (url / method / body / params gate) — the real thing, running in-container.
• src/clawbench/eval/edgebench_judge.py:55-94 — a re-implementation whose comment says it "mirrors runtime-server".

Only the mirror has tests (tests/test_edgebench_judge.py). server.py is 878 lines with zero tests and is excluded from pyright (pyproject.toml:74 excludes src/clawbench/runtime). So the copy that decides every published Intercepted number is the unverified one, and any drift between the two means offline judging disagrees with what actually happened during runs.

Ask:

1. Extract the matching predicate into a shared module (e.g. runtime/shared/matching.py) imported by both.
2. Add a parity test over a fixture matrix of url_pattern / method / body / params cases asserting both paths agree — including the regex edge cases from test(corpus): guard task-target integrity (non-empty valid-regex url_pattern + no dupes) #258 (empty pattern matches everything; malformed pattern raises inside the CDP loop and silently kills interception for the rest of the run).

[reacher-z]

@Perry2004 — filed from a read-only audit of main; every claim is cited to file:line and was re-verified by hand before filing. Flagging for your triage: happy to send a PR for any of these you want picked up, or to close it if you judge the behaviour intentional.