v3.1.31

• npm run intel: pulls recent npm advisories from the GitHub Advisory Database and lists HIGH/CRITICAL ones GuardVibe does not yet cover — the candidate list for new rules
• Daily scheduled workflow posts the gap report to the Actions summary (read-only, injection-safe, no auto-generated rules or commits)
• Discovery is automated; new rules are still human-written and must pass the release gate before shipping