feat: sync version-driven intel coverage

08-threat-intel/README.md

@@ -16,6 +16,10 @@
   - canonical advisory 级 JSON 记录，是“所有具体案例”的正式载体。
 - [registry/systems/](/Users/x/websafe/08-threat-intel/registry/systems)
   - 每个系统的统计索引、最近更新时间和案例列表。
+- [registry/entities/](/Users/x/websafe/08-threat-intel/registry/entities)
+  - 分层实体真值层，包含系统、repo、plugin、package 等已编目对象及其最新版本快照。
+- [registry/versions/](/Users/x/websafe/08-threat-intel/registry/versions)
+  - 安全相关版本历史真值层，仅保存 affected / fixed / patched / latest-secure 直接相关版本。
 - [registry/runs/](/Users/x/websafe/08-threat-intel/registry/runs)
   - 每次本地验证的 run bundle 元数据真值，用于反向回填案例页和 dashboard。
 - [registry/triage/](/Users/x/websafe/08-threat-intel/registry/triage)
@@ -53,9 +57,12 @@
 ```bash
 python3 /Users/x/websafe/scripts/intel/main.py render
 python3 /Users/x/websafe/scripts/intel/main.py validate
+python3 /Users/x/websafe/scripts/intel/main.py discover-entities
+python3 /Users/x/websafe/scripts/intel/main.py sync-versions
 python3 /Users/x/websafe/scripts/intel/main.py hotlane
 python3 /Users/x/websafe/scripts/intel/main.py ingest --since last-success
 python3 /Users/x/websafe/scripts/intel/main.py reconcile
+python3 /Users/x/websafe/scripts/intel/main.py monitor
 python3 /Users/x/websafe/scripts/intel/main.py backfill --tier rolling-24m --dry-run
 python3 /Users/x/websafe/scripts/intel/main.py ingest --since 365d --system nextjs --system vite
 python3 /Users/x/websafe/scripts/intel/main.py open-pr --dry-run
@@ -90,11 +97,11 @@ python3 /Users/x/websafe/scripts/lab/main.py serve-dashboard --port 8734
 对应的本机 cron 入口：
 
 - [run-hourly.sh](/Users/x/websafe/scripts/intel/run-hourly.sh)
-  - 处理 KEV / 在野利用 / 极高优先级更新，日志写入 `08-threat-intel/generated/logs/`
+  - 处理 KEV / 在野利用 / 极高优先级更新，并追加轻量 `sync-versions` 与 hotlane 实证队列，日志写入 `08-threat-intel/generated/logs/`
 - [run-nightly.sh](/Users/x/websafe/scripts/intel/run-nightly.sh)
-  - 处理常规增量同步
+  - 处理 `discover-entities -> sync-versions -> ingest --since last-success -> lab run-batch`
 - [run-weekly-reconcile.sh](/Users/x/websafe/scripts/intel/run-weekly-reconcile.sh)
-  - 回看最近 30 天，重新对齐 NVD / OSV / vendor 更新
+  - 回看最近 30 天，执行深度 `sync-versions --deep`，并重跑失败/排队的 lab 任务
 
 ## 入口文档