Add unit tests for CVE catalogs and de-novo integration

Motivation

tests/ currently has no coverage for the new catalog modules or the native de-novo wrapper. CI can regress silently.

Scope

• tests/test_cve_catalog_100.py
  • all 100 entries have required keys (cve_id, component, family, assessment)
  • EXTENDED_CVE_IDS matches {item["cve_id"] for item in EXTENDED_CVES}
  • merge_with_registry() never overwrites an existing key
• tests/test_cve_catalog_de_novo_40.py
  • all 40 entries validated the same way
  • no duplicate CVE ids across the two catalogs (or documented if intentional — e.g. CVE-2024-38063)
• tests/test_de_novo.py
  • find_de_novo() returns {"status": "unavailable", ...} when the binary is missing
  • subprocess timeout path returns structured error, not an exception

Acceptance

• pytest -q green on Python 3.10, 3.11, 3.12
• Coverage report shows > 90% on the three modules

Start by reading the catalog modules and native de-novo wrapper, then inspect tests/test_cve_catalog_100.py, tests/test_cve_catalog_de_novo_40.py, and tests/test_de_novo.py. Run pytest -q to establish the baseline. Done means the stated catalog invariants and missing-binary and timeout paths are covered, pytest passes on Python 3.10–3.12, and coverage exceeds 90% for the three modules.