test(advisory): add live-verified vendor-specific CVE examples and end-to-end tests across all vendor CVE namespaces #218

Agent: Gemini (SecID governing agent)

Problem

When resolving a CVE across sources (secid:advisory/CVE-...), global CVE registries (mitre.org/cve, nist.gov/nvd, cisa.gov/vulnrichment) resolve any valid published CVE, whereas vendor-specific CVE trackers only return HTTP 200 (and valid JSON on ?parsability=structured endpoints) for CVEs that apply to that vendor:

• redhat.com/cve (HTML + Hydra REST JSON) & redhat.com/bugzilla (currently missing examples)
• microsoft.com/msrc (Update Guide HTML + SUG v2.0 JSON API)
• paloaltonetworks.com/pan-sa (HTML + CVE JSON + CSAF JSON)
• ubuntu.com/cve-tracker (HTML + .json endpoint; currently lists CVE-2024-1234 which is a WordPress plugin CVE not in Ubuntu)
• debian.org/tracker (currently missing examples)
• suse.com/bugzilla (currently lists CVE-2024-1234, a WordPress plugin CVE not in SUSE)
• oracle.com/alert (out-of-band CVE alerts, e.g. CVE-2021-44228)
• cisa.gov/kev & cisa.gov/vulnrichment (vulnrichment still lists CVE-2024-1234 which 404s on cisagov/vulnrichment)
• mitre.org/cve (cveawg.mitre.org/api/cve/{id} child node currently has no examples)
• Data-only vendor CVE sources (apache.org/security, atlassian.com/jira-security, google.com/chrome, google.com/android, openssl.org/secadv)

Testing with a single CVE (e.g. Android's CVE-2026-0019 or CVE-2024-1234) leaves vendor-specific endpoints returning 404 in end-to-end verification.

Deliverable

1. Audit every ^CVE-\d{4}-\d{4,}$ child node across all 15 CVE-matching namespaces in registry/advisory/.
2. Ensure every URL-resolving vendor CVE child node (both HTML/scraped and JSON/structured) has a live-verified, vendor-appropriate CVE in data.examples that returns HTTP 200 (and valid JSON where parsability: "structured").
3. Replace non-matching placeholder CVEs (such as CVE-2024-1234 on Ubuntu, SUSE, and CISA Vulnrichment) with real CVEs tracked by each vendor, and fill missing examples on redhat.com/bugzilla, debian.org/tracker, mitre.org/cve (CVE API), and google.com/android.
4. Add vendor-specific CVE resolution & ?parsability=structured regression tests in SecID-Service and SecID-Server-API.