Dependency on watch

CVE triage log

Each row is one match between the fixture project's pinned dependency and our hardcoded CVE manifest. The cron opens the PR, watches its test suite, and posts a single recommendation. The dashboard layer above this reads through the same endpoint.