advisory-scan: eliminate spurious '?' — url punctuation, stale URL, and ? semantics

The 2026-08-07 regeneration rendered '?' for 5 of 21 recipes. '?' is meant to be a
rare 'we tried and could not tell'; at that rate it is indistinguishable from noise
and hides the real unknowns. Three causes, none of them genuine uncertainty:

1. URL EXTRACTION BUG (mine). The registry is markdown, so urls appear inside
   `backticks` and 'quotes'. The extractor captured the trailing punctuation, so
   it fetched https://docs.n8n.io/release-notes/` and https://git.autonomic.zone'`
   — both 404 on the malformed url, both 200 when clean. Trailing markdown
   punctuation is now stripped. Fixed immich + n8n.
2. STALE REGISTRY URL. mattermost-lts pointed at
   docs.mattermost.com/about/mattermost-changelog.html, which 404s; the page moved
   to /deploy/. Corrected (same class as the pgautoupgrade fix).
3. WRONG SEMANTICS FOR 'NO UPGRADE'. lasuite-docs and custom-html-tiny were
   up-to-date this run, so no scan block existed and the report fell back to '?'.
   But a recipe with no upgrade has nothing an upgrade could have fixed — that is
   0, not unknown. The report skill now says so explicitly, restricts '?' to scans
   that RAN and reported genuinely failed sources, states that benign notes
   (no-advisories-published / template URL) never trigger '?', and instructs that
   many '?' is itself a bug to raise in the Addendum.

Result across all 16 scanned recipes of that run: 0 failed sources (was 5).
Counts also improved with the classifier fix: discourse 130->133, keycloak ->7.

cc-ci-plan/advisory-scan.py

@@ -114,8 +114,12 @@ def registry_urls(recipe: str, registry_dir: str) -> tuple[list[str], str | None
         return [], None
     urls = []
     for u in re.findall(r"https?://[^\s)|\]]+", text):
-        u = u.rstrip(".,;")
-        if u not in urls:
+        # The registry is MARKDOWN: urls appear inside `backticks`, 'quotes', **bold**, and at the
+        # end of sentences. Trailing punctuation captured into the url makes the fetch 404 and the
+        # recipe render '?' for no real reason — that is what put immich and n8n in the unknown
+        # column on 2026-08-07 (https://docs.n8n.io/release-notes/` ← note the backtick).
+        u = u.rstrip("`'\"*.,;:>)")
+        if u and u not in urls:
             urls.append(u)
     return urls, path
 

cc-ci-plan/upstream/mattermost-lts.md

@@ -2,7 +2,7 @@
 
 | service  | image                                     | source repo                                       | releases / changelog                                              |
 |----------|-------------------------------------------|---------------------------------------------------|-------------------------------------------------------------------|
-| app      | mattermost/mattermost-team-edition        | https://github.com/mattermost/mattermost          | https://docs.mattermost.com/about/mattermost-changelog.html       |
+| app      | mattermost/mattermost-team-edition        | https://github.com/mattermost/mattermost          | https://docs.mattermost.com/deploy/mattermost-changelog.html       |
 | postgres | postgres                                  | https://github.com/postgres/postgres              | https://www.postgresql.org/docs/release/                          |
 
 ## Standing notes