NVD and CVE Enrichment

NVD stops scheduling enrichment for roughly 30,000 pre-March-2026 CVEs

Those records now carry the status Not Scheduled with no published completion target, so any prioritization pipeline keyed to an NVD base score will read them as absent rather than unscored. The fallback has to be built locally.