Improve recipe advisory coverage and report non-CVE fixes

cc-ci-plan/upstream/rustdesk-server.md

@@ -5,11 +5,11 @@
 | app | rustdesk/rustdesk-server | https://github.com/rustdesk/rustdesk-server | https://github.com/rustdesk/rustdesk-server/releases |
 | signal | rustdesk/rustdesk-server | https://github.com/rustdesk/rustdesk-server | https://github.com/rustdesk/rustdesk-server/releases |
 
+- nvd-cpe: rustdesk-server = cpe:2.3:a:rustdesk:rustdesk_server:*:*:*:*:oss:*:*:*
+
 ## Standing notes
-- **NOT enrolled** in the cc-ci weekly set (operator 2026-10-30: single client, maintenance contract
-  pending). Mirror `recipe-maintainers/rustdesk-server` exists + this registry entry so one-off
-  `/recipe-upgrade` runs and advisory scans work; if the client confirms, enroll via `/recipe-enroll`
-  (test suite + bridge + used-recipes weekly row).
+- Enrolled in the cc-ci weekly set. The NVD CPE above is scoped to the open source server edition;
+  do not count RustDesk Client or Server Pro CVEs for this recipe.
 - Both services (`app` = hbbs, `signal` = hbbr) use the SAME image — always bump them together.
 - Docker Hub has stray `1.4.5-*` arch tags (pushed 2026-01-12, top-level `1.4.5` tag deleted, no
   GitHub release) — an aborted/alias push, NOT a real version line. The real line is `1.1.x`;