CVEhound 1.4.0

• Added an optional bundled coccinelle: pip install 'cvehound[spatch]' brings a prebuilt, tailored spatch (cvehound-spatch, Linux x86_64 and aarch64), so scanning no longer requires coccinelle on the system
• Made spatch resolution explicit and documented: --spatch (or a spatch config key), then $CVEHOUND_SPATCH, then the bundled package, then PATH; a binary named explicitly is an error when it does not resolve, and reports record which one produced the findings
• Converted all 534 coccinelle rules from @script:python reporting to * context mode, and cvehound now parses spatch's diff — rules no longer need a python-enabled spatch, and a detection and the locations it reports can no longer disagree
• Fixed a CVE-2023-42753 false positive on linux-next, Files: coverage for CVE-2021-28971 and CVE-2021-3656, and CVE-2022-1016 guarding on a file other than the one it detects in; sped up CVE-2016-5195, CVE-2017-1000112, CVE-2019-14821 and CVE-2021-28971 detection by orders of magnitude
• Reworked out-of-band content updates: cvehound update installs a checksummed, versioned rules+metadata set atomically under ~/.local/share/cvehound/ and never touches the installed package; --version and JSON reports now record which content produced the findings
• Made a missing diff(1) an error instead of a silent no-detection run, and report what spatch said when it fails
• Fixed python -m cvehound crashing on Python 3.14 and macOS under the forkserver/spawn start methods
• Dropped support for coccinelle < 1.1.0

Full Changelog: 1.3.0...1.4.0