feat: add authorized remote and daily assessment workflows

[Labeeb2339]

What changed

• add scan-host for explicitly authorized, bounded TCP discovery and safe service fingerprinting across one host, IP, or IPv4 CIDR
• preserve protocol-bound HTTP/TLS/SSH/FTP/SMTP/POP3/IMAP evidence and add reviewed OpenSSH, Apache HTTP Server, Dropbear, ProFTPD, vsftpd, and Exim CPE mappings
• add explicit-online NVD candidate correlation with full applicability/status preservation, rate limits, deduplication, and fail-closed finding gates
• add bounded, privacy-reduced Nmap XML and Nuclei JSONL import workflows
• add explicit db status and db update commands for an externally installed Trivy; scans and status remain offline and updates are never implicit
• require Trivy itself to open the database before reporting ready; corrupt/truncated/random databases fail with exit 3
• add a Draft 2020-12 database-status schema and reduced/private path handling
• add signed managed install, update, exact-version rollback, failure rollback, receipt/hash tamper rejection, and offline uninstall
• add Windows Server 2022/2025 CI, CodeQL, live loopback assessment, performance budgets, socket churn, Docker-forwarded remote validation, daily-use docs, and structured contribution templates
• harden the release workflow with scoped eSigner secrets, immutable assets, full-SHA action pinning, and a tag-restricted approval environment

Safety and claim boundary

Remote work requires --authorized. PortCVE does not exploit, authenticate, brute-force, fuzz, evade, crawl, follow redirects, or send state-changing methods. CVE output remains candidate or known-advisory evidence with exploitability: not_assessed.

Local vulnerability scans never pull an image or update Trivy/database data implicitly. Default JSON is privacy-reduced; exact paths, target identity, raw network evidence, and immutable image IDs require --include-private.

Incomplete DNS, endpoint, identity, provider, database, import, or policy evidence fails closed for --strict and finding gates. A documented pre-1.0 residual remains: path-component validation cannot fully defeat a malicious same-user process that swaps an ancestor between validation and file I/O.

Validation

• locked restore, repository-wide formatting, and Release build: passed; 0 warnings/errors
• .NET tests: 386/386 passed
• Windows PowerShell 5.1 installer lifecycle: 66 checks passed
• six Draft 2020-12 schemas: structurally valid with runtime contract tests
• staged patch and full 11-commit history: clean under gitleaks
• current NuGet sources: no known vulnerable direct or transitive packages
• self-contained Windows x64 publish: exactly one executable, no PDB or local build-path leak
• Trivy 0.73: explicit update/status ready; corrupt database rejected; reduced JSON contained no local path
• pinned local Docker image: 87 known-advisory matches (3 critical, 17 high); --fail-on high returned 1; default JSON omitted image ID
• Docker Desktop 28.3.2: TCP/UDP echo, CIM tuples, redaction, lock/check, authorized forwarded-port scan, and cleanup passed
• live loopback remote harness: OpenSSH and silent Apache on nonstandard ports; active mode sent exactly one HEAD /; no unsafe methods or online advisory request
• performance gate: 10 inventory runs over 144 endpoints at 215 ms p95; 1,000-port passive loopback report in 1,206 ms; 51.7 MiB peak working set
• final adversarial audit: no remaining code P0/P1

Release status

This remains 0.2.0-alpha.1, not 1.0. No finalized signed PortCVE binary exists yet, and no release tag is created by this PR. The fail-closed release pipeline still requires Labeeb to complete public-trust publisher validation and configure the four protected eSigner secrets plus the exact signer subject. Independent reviewer/self-review-prevention is also still unavailable for this solo-maintainer repository.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0d9a97548b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Treat invalid UTF-8 as a lenient record error

When import nuclei runs without --strict, an invalid UTF-8 line still aborts the entire import because StrictUtf8.GetString(bytes) throws DecoderFallbackException before the per-record exception handler. PentestImportService then converts that into a file-level InvalidDataException, so valid later lines are not retained, contrary to the documented lenient behavior for malformed lines. Catch the decoding failure within record processing and route it through HandleInvalid when strict is false.

Useful? React with 👍 / 👎.