Enhancement: include EPSS/exploitability fields in vg scan --vulns JSON when present

[vibgrate-team]

Context

Severity/CVSS alone does not rank urgency. When the local advisory corpus (or --package-manifest offline bundle) already carries EPSS or similar exploitability signals, machine-readable vg scan --vulns JSON should surface them so CI and agents can sort without a second tool — still local-first.

What to do

• Extend the vulns JSON contract to optionally include EPSS (and/or related exploitability fields) when present in the advisory data used for the scan.
• Omit the fields (or null) when absent — never invent scores; absent must not render as 0 if that conflicts with existing null-score rules.
• Document the fields; keep SARIF/human output behavior unchanged unless a trivial consistent addition is clearly better.
• No new default network dependency for EPSS fetches in offline/--package-manifest mode.

Acceptance

• JSON schema/docs list the optional fields
• Absent scores stay absent (not coerced to 0)
• Offline scan path does not phone home for EPSS
• Deterministic ordering of findings unchanged for fixed input
• DCO sign-off (git commit -s)