advisory-scan: eliminate spurious '?' — url punctuation, stale URL, and ? semantics

The 2026-08-07 regeneration rendered '?' for 5 of 21 recipes. '?' is meant to be a
rare 'we tried and could not tell'; at that rate it is indistinguishable from noise
and hides the real unknowns. Three causes, none of them genuine uncertainty:

1. URL EXTRACTION BUG (mine). The registry is markdown, so urls appear inside
   `backticks` and 'quotes'. The extractor captured the trailing punctuation, so
   it fetched https://docs.n8n.io/release-notes/` and https://git.autonomic.zone'`
   — both 404 on the malformed url, both 200 when clean. Trailing markdown
   punctuation is now stripped. Fixed immich + n8n.
2. STALE REGISTRY URL. mattermost-lts pointed at
   docs.mattermost.com/about/mattermost-changelog.html, which 404s; the page moved
   to /deploy/. Corrected (same class as the pgautoupgrade fix).
3. WRONG SEMANTICS FOR 'NO UPGRADE'. lasuite-docs and custom-html-tiny were
   up-to-date this run, so no scan block existed and the report fell back to '?'.
   But a recipe with no upgrade has nothing an upgrade could have fixed — that is
   0, not unknown. The report skill now says so explicitly, restricts '?' to scans
   that RAN and reported genuinely failed sources, states that benign notes
   (no-advisories-published / template URL) never trigger '?', and instructs that
   many '?' is itself a bug to raise in the Addendum.

Result across all 16 scanned recipes of that run: 0 failed sources (was 5).
Counts also improved with the classifier fix: discourse 130->133, keycloak ->7.

.claude/skills/recipe-report/SKILL.md

@@ -42,10 +42,17 @@ keeps every weekly edition looking the same regardless of which model writes the
        Advisories + vendor security pages + OSV, with severities and fixed-in versions). Treat its
        CVE list as a **further source** and report the **UNION** of it and what you found by reading.
        Its entries are machine-derived with advisory IDs, so prefer them for CVE ids / severities /
-       fixed-in versions, and cite the GHSA where present in the Security Bulletin. If a recipe has
-       no scan block, or the block lists **failed sources**, the count is **not** authoritative:
-       render the cve cell as `?` (unknown), never `none` — a blank that reads as "clean" is exactly
-       how two CVSS-9.8 gitea RCEs were reported as "none" on 2026-08-07.
+       fixed-in versions, and cite the GHSA where present in the Security Bulletin. If the block
+       lists **failed sources**, the count is **not** authoritative: render the cve cell as `?`
+       (unknown), never `none` — a blank that reads as "clean" is exactly how two CVSS-9.8 gitea
+       RCEs were reported as "none" on 2026-08-07.
+     - **`?` must stay RARE — it means "we tried and could not tell", not "we didn't look".** Use it
+       ONLY when a scan ran and reported genuinely failed sources. In particular: a recipe with **no
+       upgrade this run** (up-to-date/skipped) has nothing an upgrade could have fixed — report `0`,
+       not `?`. A recipe with a clean scan reports its number (including `0`). Benign notes in a scan
+       block (`no-advisories-published`, `skipped: template URL`) are NOT failures and must not
+       trigger `?`. If you find yourself rendering `?` for many recipes, that is a bug to report in
+       the Addendum, not a normal outcome.
      Anything **critical/high** also gets a `security` bulletin entry (recipe · CVE id(s) + severity ·
      what it fixes · PR link); be specific about severity and what's exposed if not merged.
    - **Lead — ONE short paragraph.** A tight, concrete opener in opus's voice: fleet state in a sentence

cc-ci-plan/advisory-scan.py

@@ -114,8 +114,12 @@ def registry_urls(recipe: str, registry_dir: str) -> tuple[list[str], str | None
         return [], None
     urls = []
     for u in re.findall(r"https?://[^\s)|\]]+", text):
-        u = u.rstrip(".,;")
-        if u not in urls:
+        # The registry is MARKDOWN: urls appear inside `backticks`, 'quotes', **bold**, and at the
+        # end of sentences. Trailing punctuation captured into the url makes the fetch 404 and the
+        # recipe render '?' for no real reason — that is what put immich and n8n in the unknown
+        # column on 2026-08-07 (https://docs.n8n.io/release-notes/` ← note the backtick).
+        u = u.rstrip("`'\"*.,;:>)")
+        if u and u not in urls:
             urls.append(u)
     return urls, path
 

cc-ci-plan/upstream/mattermost-lts.md

@@ -2,7 +2,7 @@
 
 | service  | image                                     | source repo                                       | releases / changelog                                              |
 |----------|-------------------------------------------|---------------------------------------------------|-------------------------------------------------------------------|
-| app      | mattermost/mattermost-team-edition        | https://github.com/mattermost/mattermost          | https://docs.mattermost.com/about/mattermost-changelog.html       |
+| app      | mattermost/mattermost-team-edition        | https://github.com/mattermost/mattermost          | https://docs.mattermost.com/deploy/mattermost-changelog.html       |
 | postgres | postgres                                  | https://github.com/postgres/postgres              | https://www.postgresql.org/docs/release/                          |
 
 ## Standing notes