Improve recipe advisory coverage and report non-CVE fixes

cc-ci-plan/recipe-report.py

@@ -30,7 +30,7 @@ SPEC SHAPE (the agent writes this JSON):
   {"date":"YYYY-MM-DD","subtitle":"Week of <human date>",
    "lead":"<ONE short paragraph>",
    "table":[{"recipe":"x","change":"a → b","status":"GREEN|FAILED|STALE|SKIPPED|UPTODATE",  # -> TESTS col
-             "cve":16,                       # number of CVEs this PR fixes; 0/omit for none
+             "cve":16,                       # CVE count; "YES" for advisory without CVE ID; "?" unknown
              "ci":"build 154 ✓","ci_url":"…","pr":"#4","pr_url":"…","notes":"…"}],
             # ROWS SORTED by recommended priority to address — recipes WITH CVEs first, then failures,
             # then stale-tests, then routine green, then up-to-date/skipped.
@@ -232,6 +232,8 @@ def _table(rows, repo_url=None):
         # int is the confirmed CVE count; 0/omit is a confirmed-clean scan.
         if isinstance(cve, str) and cve.strip() == "?":
             cve_cell = '<span class="muted" title="advisory scan incomplete or absent — CVE count unknown">?</span>'
+        elif isinstance(cve, str) and cve.strip().upper() == "YES":
+            cve_cell = '<span class="cve">YES</span>'
         elif isinstance(cve, (int, float)) and cve:
             cve_cell = f'<span class="cve">{int(cve)}</span>'
         else: