feat(scan): a CVE from KEV or MSRC alone is judged through NVD's record

[maksimtech]

Audit finding PR-01, step 01b-2 (docs/DESIGN.md §5.3). Stacked on #59: review that first. After it is squash-merged I'll retarget this one to main.

What was wrong

CISA KEV and MSRC carry no cpeMatch. For an entry with an installed version, a CVE that reached the scan only through them came out as "not evaluable: NVD's record of it was not part of this scan". Those are the CVEs that matter most, because KEV lists what is being exploited, and the scan had the means to ask.

What changes

• nvd.records_for(ids, keyword) asks NVD by id (cveId=). It is paced like every other NVD request: the pacing closure moved to _pacer, shared with fetch_cves, and the existing pacing tests are unchanged and green.
• nvd.with_records_for_the_rest merges NVD's record into each row that has none, which brings the configurations and the score with it. The CLI and the API call it only for an entry they can judge: an entry matched by name costs no request.
• When NVD cannot be asked, the CVE stays not evaluable. The CLI says "NVD could not be asked about N CVEs from other sources (…)"; the API lists the failure in errors.
• docs/nis2-compliance.md: the NVD row now says that, for a versioned entry, the ids of CVEs found only by KEV or MSRC are sent.

Tests (strict TDD)

tests/test_judge_through_nvd.py, 11 tests:

• NVD answers from the recording nvd_cve_2026_48092.json (cveId, 2026-10-07; 7-Zip 9.34 ≤ v < 26.01) and nvd_no_results.json.
• The KEV catalogue is derived, as the file says: one entry in KEV's shape, because CVE-2026-48092 is not in KEV.
• Cases covered:
  • 24.09 affected, fix stated in 26.01, NVD's score replacing KEV's UNKNOWN;
  • 26.01 not affected;
  • no request for an unversioned entry;
  • no second request when the keyword search already returned the CVE;
  • lookup failure in the CLI and in the API.

Seen failing first (8 red before the code). 9/9 mutants killed. Full suite: 2199 passed; ruff and mypy clean.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
96.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[maksimtech]

Folded into #64, which now targets main with every commit of the stack: one review, one merge, no conflicts from squash merges.