vulnscan-ai 0.4.3

Offline deterministic remediation catalog — fix works air-gapped

Package/advisory findings (dnf/oscap) are now planned by a deterministic offline catalog with no AI call and no network: a scoped dnf update -y --advisory=<id> (or dnf update -y <package>) built locally. A host with no AI provider configured is no longer a dead end, and package fixes are reproducible (same finding → same plan). The AI provider is reserved for config/service findings that genuinely need reasoning.

New:

• fix --offline — plan only from the catalog, never call a provider (air-gapped); config findings that need reasoning are reported as "no offline plan" and skipped.
• fix --no-catalog — disable the catalog, use the AI provider for every finding.
• config key offline_catalog (default true; --offline overrides it).

Safety: command construction is injection-safe — the advisory is accepted only on a full-string match and the package name is allowlist-validated, so a crafted finding cannot inject extra dnf arguments (in-process or in an exported script). Plans still pass the deny-list / no-shell screen and require approval.

The web dashboard's apply-fix is catalog-first too, and scheduled --plan produces a deterministic plan offline. Findings with no offline plan are surfaced and skipped (never falsely reported as applied).

244 tests, bandit clean. Signed el9 + el10 packages below; install via the signed repo at https://repo.techhack.nl.