Adapted pick of fe71246. Adds the vulnerability_finding result type,
missingStatusOutcome for sources whose rows are the finding, and Defender
profile 1.1.0. The Work deviation filter uses the canonical predicate
through isDeviationRecord; Michael's GPO status logic and status cache
stay in front of it.
The constraint migration is renumbered from 022 to 027. The CVE
enrichment commit e048295 is skipped for now.
Partial pick of 5fbbda2. One finding per CVE with an Affected Devices
table and device count; the Finding Reader hides the raw Source
Observations field.
Left out: the Affected Devices label in the Result DB row detail, since
the disclosure policy withholds affectedAsset for every row.
Adapted pick of 7d3ef5f. The profile declares the now mandatory
securityScoring, priorityBasis and timeslotComparison. Client Info adds
Defender as a third tab beside Overview and AI Overview, and a
Defender-only timeslot starts in the Defender view. recordTitleFor only
replaces the title candidate; the Maester and CIS title rules stay.
Left out: the .gitignore entry, --tile-inset, the stored-profile
precedence Michael's fileProfile already has, and the old processing
version assertion.
Binh