LH-1.4: Zero Wire context and offline assessment workflow

LH-1.4 adds optional current vulnerability context while preserving the operator-collected, evidence-only assessment workflow.

• An operator runs vulnerability-context.py on a macOS/Linux analysis workstation to fetch Zero Wire RSS and CISA KEV. It never reads or uploads a server report.
• Saved snapshots include original responses, timestamps, hashes and source gaps. Offline normalization verifies and replays them without network access.
• The assessment prompt uses supplied context, requires official vendor applicability and active-fix evidence, and adds a dated, unscored CVE appendix. Public advisory research requires explicit allowance; offline analysis is the default.
• The guide and 20-page PDF link Cloudflare's 3 November 2026 Zero Wire announcement. Assessment, approved hardening changes and disposable-lab reproduction remain separate guides.

Start with README.md and vulnerability-context.md in the complete ZIP. The 28-control LH-1.2 catalogue and server collection scripts are unchanged. The helper is a curated intelligence aid, not a complete CVE scanner or proof that a server is safe.

Validated with 19 new offline fixtures, the existing local suites, a live public-feed fetch and byte-identical offline replay. The ZIP, checksums and PDF were checked. Dated validation metadata is included; no new VM test run or website deployment is claimed. Interactive website browser validation remains outstanding.

Assets: complete toolkit ZIP, assessment PDF, full prompt and SHA256SUMS. Retain the release version and checksum receipt with your assessment. Hashes provide integrity checks, not independent author attestation.