vuln-watch 1.0.0

First public release.

• Runs as a GitHub Action (uses: vancoder1/vuln-watch@v1) on Node 24, straight from source, with
  no dependencies and no build step.
• Checks each component in inventory.json against CISA KEV, NVD (exact-version CPE matching) and
  OSV, with endoflife.date for the fix hint and EPSS for display.
• Keeps one GitHub issue per finding: opens, edits with a comment when the facts change, closes when
  the problem is gone, and reopens a muted issue only when it gets worse.
• A status issue with the whole inventory, failed sources and a weekly heartbeat comment.
• A source that fails, or answers in a format vuln-watch does not recognise, closes nothing.
• Inventory validation rejects unknown fields, so a typo never means "checked less".

Use it: uses: vancoder1/vuln-watch@v1 (moves with 1.x) or pin v1.0.0 by SHA. Quick start in the README.