docs(contributing): document advisory DB setup for full test suite

CONTRIBUTING.md

@@ -11,12 +11,22 @@ All contributions to this project are voluntary and unpaid. By opening a pull re
 1. Find an open issue labeled [`good first issue`](https://github.com/OWASP/cve-lite-cli/labels/good%20first%20issue) or [`help wanted`](https://github.com/OWASP/cve-lite-cli/labels/help%20wanted).
 2. Comment on the issue to let others know you are working on it.
 3. Fork the repo and create a branch: `git checkout -b feature/issue-NNN-short-description`.
-4. Make your changes, add tests, and run `npm test` and `npm run build` to verify everything passes.
+4. Make your changes, add tests, and run the verification sequence under [Code standards](#code-standards).
 5. Open a pull request with `Closes #NNN` in the body.
 
 ## Code standards
 
-- Run `npm test` and `npm run build` before submitting. PRs with failing tests will not be merged.
+- Run this sequence before submitting. It matches CI exactly. PRs with failing tests will not be merged.
+
+  ```sh
+  npm ci
+  npm run lint:tests
+  npm run build
+  node dist/index.js advisories sync
+  npm test
+  ```
+
+  `advisories sync` populates the local advisory database. E2E tests that scan with `--offline` read from it. Without the sync step, those tests fail while the rest of the suite passes.
 - Keep changes tightly scoped to the issue. Do not refactor unrelated code in the same PR.
 - New utility functions belong in a focused module under `src/utils/` - not inlined in `src/index.ts`.
 - Use `node:fs`, `node:path`, etc. for Node built-in imports.