VulnFuse v0.4.12: standalone OpenVEX feedback

[CAOShurong]

VulnFuse v0.4.12 adds conservative ingestion of standalone OpenVEX documents across the core library, CLI, browser workbench, and bundled GitHub Action.

The important boundary is intentional: producer status such as not_affected or fixed remains attributable evidence and never becomes a suppression or successful gate verdict. The release also does not authenticate authors, verify signatures or attestations, fetch JSON-LD contexts, inherit products from enclosing documents, evaluate version ranges, or prove reachability or safety.

The implementation was exercised against pinned fixtures from openvex/vexctl and Aqua VEX Hub, malformed statements, a corroborating labeled CSV, clean npm packages, the extracted Action archive, and the public desktop/mobile workbench. That is compatibility evidence, not a claim that every producer variant works.

If you use OpenVEX, useful feedback would be:

1. Which producer and exact version generated the document?
2. Does it use nested subcomponents, hash-only subjects, multiple context values, or an attestation envelope?
3. Which evidence should remain visible when the VEX status conflicts with a scanner finding?
4. Can you share a sanitized fixture through the format compatibility issue template?

Release and checksummed downloads: https://github.com/CAOShurong/vulnfuse/releases/tag/v0.4.12
Format issue template: https://github.com/CAOShurong/vulnfuse/issues/new?template=format.yml