v3.10.0

• npm run intel --scaffold now drafts a ready-to-review rule + version-range test for each uncovered advisory (printed only; never auto-committed)
• Threat intel cross-references the CISA Known-Exploited-Vulnerabilities catalog and surfaces actively-exploited CVEs first
• New tested semver-range to 0-FP-regex generator; no rule or tool changes (441 / 37); gate green (PASS/A/0)