add /cve-check and /cve-check-and-upgrade

/cve-check answers 'what are we exposed to that an upgrade would fix?' without
running an upgrade: per-recipe, resolve the available window for EVERY image
(sidecars included), run the advisory scan over it, adjudicate whatever pass 1
could not decide, publish a report. Read-only — no PRs, no CI, no merges.

/cve-check-and-upgrade does that sweep, then runs /recipe-upgrade only on the
recipes whose upgrade actually closes a CVE, worst severity first, and reports
on both. --min-severity high for just the urgent ones; --dry-run prints the
queue and stops. Never merges.

Deliberate choices, each written into the skills:
- externals are SWEPT but never upgraded here — a security sweep that skipped
  deployed software would misreport exposure, but we don't maintain them.
- an unknown count never justifies an upgrade AND is never treated as clean;
  it goes to the Addendum.
- no upgrade available means 0 CVEs, not '?'.
- subagents are told which CVEs justify their upgrade, so the PR says why it
  exists — a PR naming the RCE it closes gets reviewed sooner.

recipe-report.py grows a page kind: 'cve' files as cve-DATE.html so a sweep
can't overwrite a weekly edition, while BOTH appear in the same archive index,
suffixed 'full report' / 'CVE check'.

/help and /cc-ci-status updated to route to them.

.opencode/skills/cc-ci-status/SKILL.md

@@ -106,6 +106,12 @@ systemctl --failed --no-legend; df -h / | tail -1; tmux ls
 1. <finding> → /<skill> (or operator action)
 …
 ```
+When a finding is that the fleet's **security exposure is unknown** — the last weekly run failed or
+is stale, so nobody has scanned for CVEs recently — the recommended step is **`/cve-check`** (read-only,
+minutes, no PRs). If it is instead that a known CVE is sitting unpatched, recommend
+**`/cve-check-and-upgrade`** (add `--min-severity high` when only the urgent ones matter). Prefer
+`/cve-check` over waiting for the next weekly run whenever the question is "are we exposed?".
+
 `ALL HEALTHY` requires: recent successful weekly run + published report, no stale tests, no
 CVE PR open >14 days, both hosts <30 days behind their channel, zero failed units, disk under
 thresholds, bridge clean, maintained-set consistent. Anything else is a finding — even minor

.opencode/skills/help/SKILL.md

@@ -31,6 +31,14 @@ Then present the roster grouped as follows, and close with the situation guide.
   PR). `--with-tests` also fixes that recipe's stale test.
 - **/recipe-report** — (re)generate the weekly report page for report.ci.commoninternet.net.
 
+**Security (CVEs)**
+- **/cve-check** — fleet-wide CVE sweep with **no upgrading**: for every recipe, work out what
+  upgrade is available (per image, sidecars included), scan it for CVEs, and publish a CVE report.
+  Read-only and quick — the "what are we exposed to?" answer without an upgrade run.
+- **/cve-check-and-upgrade** — the same sweep, then open verified PRs **only** for the recipes whose
+  upgrade actually fixes a CVE, worst severity first. `--min-severity high` for just the urgent ones.
+  Never merges.
+
 **Tests**
 - **/cc-ci-tests-update** — fleet-wide stale-test cleanup: find tests broken by legitimate
   upstream changes, fix without weakening, verify, merge the test PRs.
@@ -73,6 +81,9 @@ ARM skills never touch cc-ci infra. After a submodule bump run `scripts/gen-ccte
 | "Run the weekly upgrades now" | `/upgrade-all` (or `systemctl start cc-ci-upgrade-all.service`) |
 | "Upgrade just <recipe>" | `/recipe-upgrade <recipe>` |
 | "The report site is stale/missing a week" | `/recipe-report` |
+| "What CVEs are we exposed to right now?" | `/cve-check` (read-only, no PRs) |
+| "A CVE just dropped — check and patch it" | `/cve-check-and-upgrade` (add `--min-severity high` to skip the noise) |
+| "Is <recipe> vulnerable?" | `/cve-check <recipe>` |
 | "Tests are red because upstream changed" | `/cc-ci-tests-update` (fleet) or `/recipe-upgrade <r> --with-tests` |
 | "A CI run failed and I don't know why" | `/ci-test-review` |
 | "Update the CI server OS/deps" | `/cc-ci-server-update` |