fix: fail closed on incomplete weekly image and CVE surveys

.claude/skills/cve-check/SKILL.md

@@ -95,8 +95,9 @@ For each recipe produce **one window per image**: `current pinned tag → newest
 the sidecars (redis, postgres, nginx …), not just the app — a sidecar bump is where discourse's only
 CRITICAL came from, and an image with no window is not counted at all.
 
-- **No upgrade available** → the recipe is `UPTODATE`; its CVE count is **`0`**, not `?`. There is
-  nothing an upgrade could fix. Record it and move on.
+- **No upgrade available** → the recipe is `UPTODATE`; its **CVEs fixed by an available upgrade**
+  count is `0`. This does not assert that the running image has no known CVEs. If advisory sources
+  failed or are blind, use `?` and say why.
 - **No output at all is NOT "no upgrade".** An abra call that times out, FATAs, or prints nothing
   leaves the recipe **unverified** — treat it as a distinct outcome, never fold it into up-to-date.
   Re-run it, and if it still yields nothing, resolve the versions by direct registry check (box item 4).
@@ -111,9 +112,17 @@ python3 cc-ci-plan/audit-sources.py --security-sources
 A recipe whose sources yield **no CVE data at all** cannot produce a meaningful `0` — nothing was
 measured, the same way a missing registry file cannot. Render those as **`?`**, not `0`.
 
-**The fleet is currently at zero such recipes.** The last two — `mattermost-lts` (empty advisory
-feed, client-side-rendered bulletins) and `mumble` (nothing published anywhere) — were fixed by
-declaring an NVD CPE in their registry:
+Do not assume that the fleet has zero blind recipes. Run the audit every sweep and inspect source
+statuses; an HTTP error or rate limit is not evidence of no CVEs. `rustdesk-server` is currently
+blind because its upstream GitHub repo publishes no security advisories and no other usable source
+has been verified; mark it `?` until that changes.
+
+Check `test -s /srv/cc-ci/.github-token` before a fleet scan. Without that read-only token,
+GitHub's anonymous API limit can be exhausted partway through the fleet; HTTP 403 results are
+failed sources, so the affected CVE counts remain unknown.
+
+Two older blind spots — `mattermost-lts` and `mumble` — were addressed by declaring NVD CPEs in
+their registries:
 ```
 - nvd-cpe: mattermost-team-edition = cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
 ```