v0.3.6

Severity judgments now follow the advisory group, not the single release

check_stack now prefers the server's group_severity — the maximum severity across every release branch sharing an advisory — when filtering, folding and building the briefing. The same fix often lands on several branches with differently-worded notes; one branch's milder wording no longer hides an issue below your severity_min.

• Facts citing only CVE ids (no GHSA or vendor advisory) now carry a cve:… group key, so branch-parallel fixes collapse into one briefing entry with one consistent severity.
• Tool and field descriptions explain the group keys and when to prefer group_severity.
• On older servers without group_severity, check_stack keeps the previous local fold.

Full Changelog: v0.3.5...v0.3.6