feat(advisories): add provisional GHSA feed (#242)

* feat(advisories): add provisional ghsa feed

* fix(workflows): include advisory signatures in checksums

* fix(workflows): mirror ghsa feed at release root

* feat(advisories): consolidate ghsa into agent feed

* ci(advisories): consolidate ghsa during nvd poll

* fix(advisories): retain unreplaced ghsa feed entries

* chore(skills): bump advisory feed consumers

* fix(release): resolve ts import closure dry run

* fix(release): preserve urls while stripping comments

* fix(release): ignore skill test-only changes

* fix(advisories): follow ghsa pagination links

* test(advisories): add nvd ghsa pipeline dry run

advisories/ghsa-without-cve.json

@@ -0,0 +1,39 @@
+{
+  "version": "0.1.0",
+  "updated": "2026-05-24T07:39:08Z",
+  "description": "Provisional ClawSec advisory feed for public GitHub Security Advisories that do not yet have CVE identifiers.",
+  "stale_after_days": 60,
+  "semantics": {
+    "active": "GHSA is published and has no CVE identifier yet.",
+    "matured": "GHSA now has a CVE identifier and should be reconciled with the canonical CVE feed.",
+    "stale": "GHSA is older than stale_after_days and still has no CVE identifier."
+  },
+  "sources": [
+    {
+      "repository": "openclaw/openclaw",
+      "platform": "openclaw",
+      "url": "https://github.com/openclaw/openclaw/security/advisories"
+    },
+    {
+      "repository": "qwibitai/nanoclaw",
+      "platform": "nanoclaw",
+      "url": "https://github.com/qwibitai/nanoclaw/security/advisories"
+    },
+    {
+      "repository": "softwarepub/hermes",
+      "platform": "hermes",
+      "url": "https://github.com/softwarepub/hermes/security/advisories"
+    },
+    {
+      "repository": "nousresearch/hermes-agent",
+      "platform": "hermes",
+      "url": "https://github.com/nousresearch/hermes-agent/security/advisories"
+    },
+    {
+      "repository": "sipeed/picoclaw",
+      "platform": "picoclaw",
+      "url": "https://github.com/sipeed/picoclaw/security/advisories"
+    }
+  ],
+  "advisories": []
+}