Linux vulnerability scanner: static Go binary, distro + OSV + NVD feeds, 63 host checks, no-install one-liner runner