advisory-scan: eliminate spurious '?' — url punctuation, stale URL, and ? semantics

The 2026-08-07 regeneration rendered '?' for 5 of 21 recipes. '?' is meant to be a
rare 'we tried and could not tell'; at that rate it is indistinguishable from noise
and hides the real unknowns. Three causes, none of them genuine uncertainty:

1. URL EXTRACTION BUG (mine). The registry is markdown, so urls appear inside
   `backticks` and 'quotes'. The extractor captured the trailing punctuation, so
   it fetched https://docs.n8n.io/release-notes/` and https://git.autonomic.zone'`
   — both 404 on the malformed url, both 200 when clean. Trailing markdown
   punctuation is now stripped. Fixed immich + n8n.
2. STALE REGISTRY URL. mattermost-lts pointed at
   docs.mattermost.com/about/mattermost-changelog.html, which 404s; the page moved
   to /deploy/. Corrected (same class as the pgautoupgrade fix).
3. WRONG SEMANTICS FOR 'NO UPGRADE'. lasuite-docs and custom-html-tiny were
   up-to-date this run, so no scan block existed and the report fell back to '?'.
   But a recipe with no upgrade has nothing an upgrade could have fixed — that is
   0, not unknown. The report skill now says so explicitly, restricts '?' to scans
   that RAN and reported genuinely failed sources, states that benign notes
   (no-advisories-published / template URL) never trigger '?', and instructs that
   many '?' is itself a bug to raise in the Addendum.

Result across all 16 scanned recipes of that run: 0 failed sources (was 5).
Counts also improved with the classifier fix: discourse 130->133, keycloak ->7.

.claude/skills/recipe-report/SKILL.md

@@ -42,10 +42,17 @@ keeps every weekly edition looking the same regardless of which model writes the
        Advisories + vendor security pages + OSV, with severities and fixed-in versions). Treat its
        CVE list as a **further source** and report the **UNION** of it and what you found by reading.
        Its entries are machine-derived with advisory IDs, so prefer them for CVE ids / severities /
-       fixed-in versions, and cite the GHSA where present in the Security Bulletin. If a recipe has
-       no scan block, or the block lists **failed sources**, the count is **not** authoritative:
-       render the cve cell as `?` (unknown), never `none` — a blank that reads as "clean" is exactly
-       how two CVSS-9.8 gitea RCEs were reported as "none" on 2026-08-07.
+       fixed-in versions, and cite the GHSA where present in the Security Bulletin. If the block
+       lists **failed sources**, the count is **not** authoritative: render the cve cell as `?`
+       (unknown), never `none` — a blank that reads as "clean" is exactly how two CVSS-9.8 gitea
+       RCEs were reported as "none" on 2026-08-07.
+     - **`?` must stay RARE — it means "we tried and could not tell", not "we didn't look".** Use it
+       ONLY when a scan ran and reported genuinely failed sources. In particular: a recipe with **no
+       upgrade this run** (up-to-date/skipped) has nothing an upgrade could have fixed — report `0`,
+       not `?`. A recipe with a clean scan reports its number (including `0`). Benign notes in a scan
+       block (`no-advisories-published`, `skipped: template URL`) are NOT failures and must not
+       trigger `?`. If you find yourself rendering `?` for many recipes, that is a bug to report in
+       the Addendum, not a normal outcome.
      Anything **critical/high** also gets a `security` bulletin entry (recipe · CVE id(s) + severity ·
      what it fixes · PR link); be specific about severity and what's exposed if not merged.
    - **Lead — ONE short paragraph.** A tight, concrete opener in opus's voice: fleet state in a sentence