Improve recipe advisory coverage and report non-CVE fixes

.claude/skills/cve-check/SKILL.md

@@ -113,9 +113,9 @@ A recipe whose sources yield **no CVE data at all** cannot produce a meaningful
 measured, the same way a missing registry file cannot. Render those as **`?`**, not `0`.
 
 Do not assume that the fleet has zero blind recipes. Run the audit every sweep and inspect source
-statuses; an HTTP error or rate limit is not evidence of no CVEs. `rustdesk-server` is currently
-blind because its upstream GitHub repo publishes no security advisories and no other usable source
-has been verified; mark it `?` until that changes.
+statuses; an HTTP error or rate limit is not evidence of no CVEs. `rustdesk-server` has an NVD CPE
+scoped to the OSS server edition; a successful zero-result query is a checked zero for that source,
+not a reason to count Client or Server Pro vulnerabilities against it.
 
 Check `test -s /srv/cc-ci/.github-token` before a fleet scan. Without that read-only token,
 GitHub's anonymous API limit can be exhausted partway through the fleet; HTTP 403 results are
@@ -178,7 +178,8 @@ Severity outranks raw count: 2 CVSS-9.8 RCEs matter more than 120 medium plugin
 - `table[]` — every recipe swept. `recipe`; `change` = the window you scanned, e.g.
   `1.27.0 → 1.27.1 · redis 7.4 → 8.10`; `status` = `UPTODATE` when nothing is available, else
   `PENDING` (an upgrade exists and is not yet taken); **`cve`** = the count (integer, `?` only per the
-  rules below); `notes` = severity mix, whether the number is a floor, and `maintained elsewhere` for
+  rules below, or `"YES"` when a confirmed security advisory has no CVE ID and no numbered CVEs
+  were found); `notes` = the advisory ID and severity, whether the number is a floor, and `maintained elsewhere` for
   `external` rows. **Leave `ci`/`pr` empty — nothing was built and no PR exists.**
 - `addendum[]` — real anomalies only: registry URLs that failed, recipes whose window could not be
   established, a scan whose count is a floor with many undetermined advisories.

.claude/skills/recipe-report/SKILL.md

@@ -52,6 +52,9 @@ keeps every weekly edition looking the same regardless of which model writes the
        A zero for an up-to-date recipe means there is no upgrade window to credit; it does not
        certify that the running images are free of vulnerabilities. If an upgrade exists but its
        advisory scan is absent, a source failed, or an image window was unmatched, use `?`.
+       If a confirmed security advisory is fixed but has no CVE ID, put `"YES"` in `cve` rather
+       than `0`; describe its advisory ID and severity in Notes. If CVE IDs are also fixed, show
+       the numeric CVE count and mention the additional non-CVE advisories in Notes.
      - **`?` means the count is not verified.** Use it when an upgrade has no scan, a source failed,
        an image window was unmatched, or the scan block says COUNT UNKNOWN. In that case publish
        `?` and say why in