v0.23.0 — SUSE's CSAF-VEX feed, consulted unasked

SUSE publishes CSAF-VEX, and vexscan now consults it by default for SUSE
images instead of leaving it behind --distro-feeds. Debian's tracker stays
opt-in.

A feed is a second opinion, never a taint. Only an exculpatory statement is
recorded; a vendor's "still affected" would add noise without changing an
answer the local scan already reached. Statements are keyed on the advisory's
RefID rather than on (package, CVE), so when one source package fans out into
several binary packages at differing versions, a "fixed" verdict for the newer
one can never land on an older one that is still vulnerable. A feed cannot stop
the local analysis from reaching its own verdict in either direction.

What it changed on two real images: nothing. On
registry.suse.com/bci/bci-base:15.6 the feed reached 7 findings and on
docker.io/rancher/hardened-calico:v3.32.0-build20260511 it reached 44, and it
cleared none of them — every statement said the package is affected with a fix
available, which is the truthful answer for an image carrying unapplied updates.
No row changed status on either image. The feed is correct and now runs unasked;
it will clear rows on images where SUSE has published a not_affected. If you
were expecting this release to rule more SLES CVEs out, it does not, and you
should not upgrade expecting a shorter report.

Also in this release: a rootless image cannot be walked for entrypoints, so
every OS finding is forced to linked. That is honest but unhelpful on its own,
and a run now says so and names --roots as the way to get a real answer.

Dropped before merge

This branch also carried a deterministic advisory-symbol extractor that ran
without --llm. It was removed. The clear fires when every validated
candidate is absent, so an empty candidate set yields no answer while a set
holding one absent token yields vulnerable_code_not_present — manufacturing
candidates does not add noise to a decision, it turns "no answer" into "not
present". Measured, it cleared seven findings across these two images on the
strength of the words OpenSSL, channels, macro, file, target, the RPM
spec macro suse_version and the PAM module name pam_userdb, three of them
with a fix the image had not applied.

A withhold-only rewrite — extracted tokens may only ever take a clear away,
never produce one — was built, mutation-tested and measured, then dropped as
well: it fired once in 715 rows and cost nothing. Correct, and not worth the
machinery.