v0.3.1

An untracked project no longer looks safe

check_stack used to answer with zero facts whether a project was tracked and quiet, or simply unknown to ratatosk — and an agent reading "no facts" as "no risk" would be wrong in the second case. Components with zero facts now carry an explicit tracked: true|false: tracked-and-quiet says the releases were read and routine, untracked says plainly that zero facts means no coverage, not safety.

Brief mode also got tighter for fact-heavy releases:

• Facts that share one quoted sentence (one extraction sentence covering several CVEs) are merged into a single entry — ids listed together, strongest severity shown, diverging applies_if conditions collected into applies_if_any. Previously the same sentence could repeat once per CVE.
• Summary counts are unchanged: they still count distinct issues.

Full Changelog: v0.3.0...v0.3.1