fix(tools): spell the OSV and CVE.org recipes with the framework runner prefix

plugins/magpie-security/skills/issue-sync/gather.md

@@ -767,7 +767,7 @@ Concretely, for each closed-`announced` tracker in this run:
    already read).
 2. Call the API:
    ```bash
-   vetted-op-read --caller security-issue-sync cve-check-published <CVE-ID> \
+   uv run --project <framework>/tools/vetted-ops vetted-op-read --caller security-issue-sync cve-check-published <CVE-ID> \
      | jq -r '{state: .cveMetadata.state, datePublished: .cveMetadata.datePublished}'
    ```
 3. Interpret:

tools/cve-org/tool.md

@@ -66,7 +66,7 @@ Recipe:
 
 ```bash
 # Read-only, no auth required. Returns JSON.
-vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
   | jq -r '.cveMetadata.state'
 ```
 
@@ -90,7 +90,7 @@ Extract the `datePublished` alongside the state when you need to
 print *"published on YYYY-MM-DD"* in the reporter email:
 
 ```bash
-vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
   | jq -r '{state: .cveMetadata.state, datePublished: .cveMetadata.datePublished}'
 ```
 

tools/osv/tool.md

@@ -66,13 +66,13 @@ Fetch the OSV JSON record by its primary ID (or alias):
 
 ```bash
 # Read-only, unauthenticated. Returns complete OSV schema JSON.
-vetted-op-read --caller <caller> osv-get-vuln <ID>
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-get-vuln <ID>
 ```
 
 Extracting alias identifiers (e.g., resolving a GHSA ID to corresponding CVE IDs):
 
 ```bash
-vetted-op-read --caller <caller> osv-get-vuln GHSA-7rjr-3q55-vv33 \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-get-vuln GHSA-7rjr-3q55-vv33 \
   | jq -r '{id: .id, aliases: .aliases, summary: .summary}'
 ```
 
@@ -90,7 +90,7 @@ Example JSON response:
 Extracting affected version ranges and fixed versions:
 
 ```bash
-vetted-op-read --caller <caller> osv-get-vuln <ID> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-get-vuln <ID> \
   | jq -r '.affected[] | {package: .package.name, ecosystem: .package.ecosystem, fixed: [.ranges[].events[] | select(.fixed != null) | .fixed]}'
 ```
 
@@ -99,7 +99,7 @@ vetted-op-read --caller <caller> osv-get-vuln <ID> \
 Check if a given package release is subject to any known advisories:
 
 ```bash
-vetted-op-read --caller <caller> osv-query-package jinja2 PyPI 2.11.2 \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-query-package jinja2 PyPI 2.11.2 \
   | jq -r '.vulns[]? | {id: .id, aliases: .aliases, summary: .summary}'
 ```
 
@@ -110,7 +110,7 @@ Common ecosystems: `PyPI`, `Maven`, `npm`, `crates.io`, `Go`, `Packagist`, `NuGe
 Check if a public upstream commit SHA is indexed in OSV as a fix or vulnerability reference:
 
 ```bash
-vetted-op-read --caller <caller> osv-query-commit <COMMIT_HASH> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-query-commit <COMMIT_HASH> \
   | jq -r '.vulns[]? | {id: .id, aliases: .aliases, summary: .summary}'
 ```
 
@@ -119,7 +119,7 @@ vetted-op-read --caller <caller> osv-query-commit <COMMIT_HASH> \
 Evaluate multiple dependencies in a single round-trip:
 
 ```bash
-vetted-op-read --caller <caller> osv-query-batch /tmp/agent-scratch/batch.json \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-query-batch /tmp/agent-scratch/batch.json \
   | jq -r '.results | to_entries[] | {query: .key, vuln_count: ((.value.vulns // []) | length)}'
 ```