Vulnerability severity calibration

A blind scan caught Wormhole's sysvar bug and walked past Cashio's missing root of trust

One scanner, two pre-exploit Solana codebases, one hit and one miss. The miss is the half that tells you which vulnerability classes static analysis can actually reach.