fix: fail closed on incomplete weekly image and CVE surveys

cc-ci-plan/recipe-report.py

@@ -217,7 +217,8 @@ def _table(rows, repo_url=None):
         return ""
     # TESTS = the CI/test verdict (GREEN/FAILED/STALE/…); STATUS = the PR's LIVE state, fetched
     # client-side (open vs ✓ for any not-open state) by the inline script in _page().
-    head = ("<tr><th>Recipe</th><th>Change</th><th>TESTS</th><th>CVEs</th>"
+    head = ("<tr><th>Recipe</th><th>Change</th><th>TESTS</th>"
+            '<th title="Known CVEs fixed by the available recipe upgrade; zero does not certify the current image as vulnerability-free">CVEs fixed</th>'
             "<th>CI</th><th>PR</th><th>STATUS</th><th>Notes</th></tr>")
     trs = []
     for r in rows: