fix: align task 135 instruction text with oracle answer

The oracle for ccx-vuln-remed-135 (Chromium sandbox audit) had correct
files/symbols but the instruction text referenced wrong class names and
directories (BPFBasePolicy→BaselinePolicy, content/browser/→sandbox/policy/linux/).
Verified all oracle paths against sg-evals/chromium--2d05e315 mirror.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sjarmak

benchmarks/ccb_mcp_security/ccx-vuln-remed-135/instruction.md

@@ -2,7 +2,7 @@
 
 ## Your Task
 
-Audit the security sandbox implementation for Chromium's renderer processes. Find all C++ source files in `chromium/chromium` that implement the sandbox: 1. The file under `sandbox/linux/` that implements `BPFBasePolicy` — the seccomp-BPF base policy for Linux sandboxing. 2. The file under `sandbox/win/src/` that defines `TargetPolicy` — the Windows sandbox policy configuration. 3. The file under `content/browser/` that configures sandbox parameters for renderer process launch (look for `SetRendererSandboxPolicy` or `GetRendererSandboxType`). 4. The file under `sandbox/policy/` that defines `SandboxType` enum and sandbox profile mappings. Report each file path and key class/function.
+Audit the security sandbox implementation for Chromium's renderer processes. Find all C++ source files in `chromium/chromium` that implement the sandbox: 1. The file under `sandbox/linux/seccomp-bpf-helpers/` that implements `BaselinePolicy` — the seccomp-BPF baseline policy for Linux sandboxing. 2. The file under `sandbox/win/src/` that implements `PolicyBase` — the Windows sandbox policy configuration (concrete implementation of `TargetPolicy`). 3. The file under `sandbox/policy/linux/` that implements `RendererProcessPolicy` — the BPF policy specific to renderer process sandboxing (look for `EvaluateSyscall`). 4. The file under `sandbox/policy/` that declares sandbox type utilities and the `SandboxType` enum mapping. Report each file path and key class/function.
 
 ## Context
 

benchmarks/ccb_mcp_security/ccx-vuln-remed-135/instruction_mcp.md

@@ -74,7 +74,7 @@ If MCP search returns no results:
 
 ## Your Task
 
-Audit the security sandbox implementation for Chromium's renderer processes. Find all C++ source files in `chromium/chromium` that implement the sandbox: 1. The file under `sandbox/linux/` that implements `BPFBasePolicy` — the seccomp-BPF base policy for Linux sandboxing. 2. The file under `sandbox/win/src/` that defines `TargetPolicy` — the Windows sandbox policy configuration. 3. The file under `content/browser/` that configures sandbox parameters for renderer process launch (look for `SetRendererSandboxPolicy` or `GetRendererSandboxType`). 4. The file under `sandbox/policy/` that defines `SandboxType` enum and sandbox profile mappings. Report each file path and key class/function.
+Audit the security sandbox implementation for Chromium's renderer processes. Find all C++ source files in `chromium/chromium` that implement the sandbox: 1. The file under `sandbox/linux/seccomp-bpf-helpers/` that implements `BaselinePolicy` — the seccomp-BPF baseline policy for Linux sandboxing. 2. The file under `sandbox/win/src/` that implements `PolicyBase` — the Windows sandbox policy configuration (concrete implementation of `TargetPolicy`). 3. The file under `sandbox/policy/linux/` that implements `RendererProcessPolicy` — the BPF policy specific to renderer process sandboxing (look for `EvaluateSyscall`). 4. The file under `sandbox/policy/` that declares sandbox type utilities and the `SandboxType` enum mapping. Report each file path and key class/function.
 
 ## Context
 

benchmarks/ccb_mcp_security/ccx-vuln-remed-135/tests/oracle_answer.json

@@ -17,7 +17,7 @@
     {"repo": "sg-evals/chromium--2d05e315", "path": "sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc", "symbol": "BaselinePolicy"},
     {"repo": "sg-evals/chromium--2d05e315", "path": "sandbox/policy/linux/bpf_renderer_policy_linux.cc", "symbol": "RendererProcessPolicy"}
   ],
-  "text": "Audit the security sandbox implementation for Chromium's renderer processes. Find all C++ source files in `chromium/chromium` that implement the sandbox: 1. The file under `sandbox/linux/` that implements `BPFBasePolicy` — the seccomp-BPF base policy for Linux sandboxing. 2. The file under `sandbox/win/src/` that defines `TargetPolicy` — the Windows sandbox policy configuration. 3. The file under `content/browser/` that configures sandbox parameters for renderer process launch (look for `SetRendererSandboxPolicy` or `GetRendererSandboxType`). 4. The file under `sandbox/policy/` that defines `SandboxType` enum and sandbox profile mappings. Report each file path and key class/function.",
+  "text": "Audit the security sandbox implementation for Chromium's renderer processes. Find all C++ source files in `chromium/chromium` that implement the sandbox: 1. The file under `sandbox/linux/seccomp-bpf-helpers/` that implements `BaselinePolicy` — the seccomp-BPF baseline policy for Linux sandboxing. 2. The file under `sandbox/win/src/` that implements `PolicyBase` — the Windows sandbox policy configuration (concrete implementation of `TargetPolicy`). 3. The file under `sandbox/policy/linux/` that implements `RendererProcessPolicy` — the BPF policy specific to renderer process sandboxing (look for `EvaluateSyscall`). 4. The file under `sandbox/policy/` that declares sandbox type utilities and the `SandboxType` enum mapping. Report each file path and key class/function.",
   "_metadata": {
     "task_id": "CCX-vuln-remed-135",
     "oracle_source": "github_verification",