ServiceRadar v1.4.37

Keeps nist-nvd2 from filling the node, stops Falco Critical from
filling the Fatal card, and force-refills the 24-hour log-severity
rollup.

Whats New

1.4.37

Advisory feeds: leftover nist-nvd2 extracts are pruned every
scheduler tick, a dedicated cleanup worker reaps orphans after
Oban :kill, downloads refuse to start when staging is over
budget, and finalize no longer statement-timeouts the generation
swap. Demo and farm01 can keep the CPE catalog enabled. (PR #3795)
Software tab: vuln matches for a device use a partial
(device_uid, kev, exploit, cvss, last_seen) index instead of
scanning the global priority index. (PR #3795)
Observability: severity_text critical (Falco/Trivy priority)
counts as Error, not Fatal. The 24-hour log-severity CAGG
force-refreshes when coverage lags. (PR #3797)
Hex: waive unpatched cowlib EEF-CVE-2026-43971 until a Hex
release exists. (PR #3797)
CI: the SRQL fixture CA is no longer published on the shared
gateway. (PR #3799)