feat(security): OSV.dev advisory feed replaces the hand-typed list as primary #5513

Scorecard move #4 of the greenlit block (agent-built)

The scorecard's "14-entry hand-typed advisory list (not a CVE feed)" is now supplemental; a real OSV.dev feed is primary:

• src/lib/osv.ts: chunked querybatch (1000/call) + per-vuln detail fetch, ecosystem mapping (npm/PyPI/crates.io/RubyGems/Go/Maven/Packagist), 10s timeouts, injectable fetch, fail-soft everywhere. 24h TTL with misses stored (clean packages don't re-query per render); failed chunks are NOT recorded as misses.
• Migration 0125: osv_advisories + osv_scan_state. schema.ts appended per convention.
• Surfaces: advisories page shows the OSV feed first (id, CVE alias, severity pill, affected/fixed, osv.dev link); deps-page chips merge OSV matches; refresh is fire-and-forget from renders (never a blocking fetch in a handler); owner Re-scan awaits the TTL-bounded refresh; autopilot rescan hooks in.
• Copy-honesty tripwires updated to name the 24h cache window and direct-deps-only scope — the pages still never overclaim.

Two-sources-of-truth finding worth reading: dependency-scanner.ts has been querying OSV on push all along — but only to open issues; the advisory UI never saw that data. This PR gives the UI its own cached OSV store; unifying the two paths is a sensible follow-up.

19/19 lib tests (chunking, mapping, TTL, fail-soft, severity extraction; DB e2e gated) + 178/178 adjacent (advisories, copy-honesty, autopilot, selfcheck migration shape…). Typecheck clean.

🤖 Generated with Claude Code