feat: add controlled vulnerability database and signed seed bootstrap

[9batalion]

Summary

• add opt-in, local-first vulnerability inventory, matching and reporting
• add controlled user-triggered staging/update, verification, reconciliation, rollback and retention
• add bounded source adapters without claiming full-feed coverage
• add real partial seed SQLite (profile=seed, completeness=partial, production_full_database=false)
• add signed pinned bootstrap and separate explicit seed activation
• fix CI self-scan handling for SQLite database assets
• bump package to 3.1.0

Seed facts

• 187 advisories / 378 affected-package rows
• OSV: 87 imported across seven represented ecosystems
• GHSA: 100 imported
• CISA KEV: 1,653 processed, 2 exact and 1,651 unresolved retained
• EPSS: 54 processed, 17 exact and 37 unresolved retained
• 129 exact-alias conflicts retained and disclosed; no heuristic merge

Verification

• full temp-clone unittest gate: 990 tests, 1 skipped (pre-final focused increment)
• focused seed/bootstrap gate: 9 passed
• SQLite integrity: ok
• foreign-key errors: 0
• real lodash@4.17.15 E2E: 6 findings with stable fingerprints
• self-scan: 0 findings, baseline stale: 0
• compileall: pass
• git diff --check: pass

Boundary

This is a verified partial seed, not Core/Full/Production/Complete. Empty seed results are not proof of no vulnerabilities. Ordinary scans do not download feeds and seed never replaces Core/Full automatically.