CVE fact check, deterministic. Answers "is CVE-XXXX-NNNN real", "is it exploited in the wild", "what version fixes it", "how severe is it". Joins the NVD record (CVSS score, vector, dates), the CISA KEV catalog (actively-exploited flag, remediation due date, ransomware use), and OSV (affected packages + fixed versions per ecosystem). No LLM. Distinguishes "not a known CVE" from "registry unreachab