v2.7.0

Latest-CVE detection & exploit awareness for tech-stack --cve / scan --cve.

Phase 3: Latest-CVE detection & CISA KEV exploit awareness

• Parse the NVD publishedDate and filter advisory references down to public exploit / PoC links (Exploit-DB, Metasploit, Packet Storm, raw GitHub PoCs), capped per CVE in nvd_cve_checker.go.
• Sort CVE results newest-first; the domain model gains Published, References, KnownExploited, and KEV fields (internal/domain/cve.go).
• CISA KEV cross-reference: the catalog is fetched once per run (cached alongside NVD data, TTL follows --nvd-cache-ttl) under a mutex so concurrent CVE checks hit it exactly once.
• Flag confirmed exploited CVEs as KNOWN EXPLOITED with CISA's remediation deadline + required action in human and JSON reports (present_techstack.go).
• Unit tests: newest-first ordering, exploit-link filtering, KEV enrichment, graceful degradation when the KEV feed is down, single-fetch-per-run.

This release also carries the previously-untagged Phase 2 (v2.6.0) work: NVD/crt.sh rate limiting, two-layer caching, and throttle transparency.