Add NIST NVD as a vulnerability source alongside OSV

[webchick]

Why

Scout's vulnerability checks query OSV only. OSV is an aggregator — for PyPI it mirrors the GitHub Advisory Database (GHSA) and the PyPA Advisory Database, and has no independent analysts of its own. CVEs that arrive through a different pipeline (for example a huntr.dev disclosure that lands in NIST NVD without a corresponding GHSA or PyPA advisory ever being filed) never reach OSV's feeds.

That's a coverage gap, not a timing lag — no amount of waiting closes it, because nothing upstream of OSV ever describes the vulnerability. Querying NVD directly is a structurally different source that catches these.

What

A new NVD check that runs in parallel with the existing OSV check:

• checks/nvd.py — new activities.nvd.check. Queries the NVD REST API v2.0 and lets NVD do server-side version-range matching via virtualMatchString (CPE product = package name, vendor wildcarded). An optional NVD_API_KEY raises the rate limit from 5→50 requests/30s; without it the check still works (graceful degradation, consistent with the project's zero-keys principle). A package whose CPE product name doesn't line up with the registry name yields an empty result — a miss, never a false positive.
• models/ — new NVDChecks model and nvd field on PackageChecks.
• classifiers/ — NVD vulnerabilities force a hard RED, unioned and deduped with OSV so a hit in either feed is sufficient. The LLM classifier surfaces the new signal through the existing model_dump path; prompt label updated to name NVD.
• workflows/ — appended to the check registry (append-only, replay-safe).

Trade-off

NVD's CPE-based matching is looser than GHSA's curated PyPI version ranges, so it can surface more false-positive version matches than OSV alone. The dedup with OSV and the hard-RED-only-on-known-CVE behavior keep this contained, but it's the reason this is additive coverage rather than a replacement for OSV.

Tests

• 5 new NVD activity tests (tests/test_activities.py), 100% coverage of checks/nvd.py.
• Replay fixtures regenerated for the new activity in the schedule sequence.
• Full suite passes (1414 tests); ruff and mypy clean.

🤖 Generated with Claude Code