release v0.9.5: kernel_range drift cleanup (12 modules)

v0.9.4 fixed cve_metadata drift but exposed kernel_range drift which
had been hidden behind it. Applied refresh-kernel-ranges.py --patch
recommendations: 11 TOO_TIGHT findings (false-positive risk — our
threshold later than Debian's earliest known fix) + 8 MISSING (Debian
has fixes for branches we didn't model) across 12 modules.

All changes are strictly correctness-improving: detect() now correctly
returns OK on kernels Debian has on record as patched, instead of
false-positiving VULNERABLE.

The biggest single fix is reverting fragnesia from {7,0,10} (NVD) to
{7,0,9} (Debian's backported fix). I introduced that off-by-one in
v0.9.4 from misreading NVD's versionEndExcluding semantics.

Build's kernel_range drift step now exits 0 with 0 TOO_TIGHT + 0 MISSING.

modules/fragnesia_cve_2026_46300/skeletonkey_modules.c

@@ -919,9 +919,9 @@ static const struct kernel_patched_from fragnesia_patched_branches[] = {
 	{5, 15, 208}, /* 5.15-LTS backport */
 	{6,  1, 174}, /* 6.1-LTS backport */
 	{6,  6, 141}, /* 6.6-LTS backport */
-	{6, 12,  91}, /* 6.12-LTS backport */
+	{6, 12,  90}, /* 6.12-LTS backport (Debian trixie ships .90 with fix) */
 	{6, 18,  33}, /* 6.18-LTS backport */
-	{7,  0,  10}, /* 7.0 stable: fix lands at 7.0.10 */
+	{7,  0,   9}, /* 7.0 stable (Debian forky/sid ship .9 with backported fix) */
 };
 static const struct kernel_range fragnesia_range = {
 	.patched_from = fragnesia_patched_branches,