fix: normalize CVE_METADATA.json to sorted order (drift-check)

The weekly drift-check stayed red after v0.9.9's KEV+CWE fixes because of a
latent ordering bug: sudo_host (CVE-2025-32462), added in v0.9.8, was
appended to the end of CVE_METADATA.json instead of its sorted position.
check_drift compares the record list in discover_cves() sorted order, so
the misplaced entry read as drift independent of its field values.
Regenerated via tools/refresh-cve-metadata.py — sorted order restored, all
field values reconfirmed against CISA KEV + NVD in a clean fetch.

core/cve_metadata.c

@@ -236,6 +236,14 @@ const struct cve_metadata cve_metadata_table[] = {
         .in_kev              = false,
         .kev_date_added      = "",
     },
+    {
+        .cve                 = "CVE-2025-32462",
+        .cwe                 = "CWE-863",
+        .attack_technique    = "T1068",
+        .attack_subtechnique = NULL,
+        .in_kev              = false,
+        .kev_date_added      = "",
+    },
     {
         .cve                 = "CVE-2025-32463",
         .cwe                 = "CWE-829",
@@ -292,14 +300,6 @@ const struct cve_metadata cve_metadata_table[] = {
         .in_kev              = false,
         .kev_date_added      = "",
     },
-    {
-        .cve                 = "CVE-2025-32462",
-        .cwe                 = "CWE-863",
-        .attack_technique    = "T1068",
-        .attack_subtechnique = NULL,
-        .in_kev              = false,
-        .kev_date_added      = "",
-    },
 };
 
 const size_t cve_metadata_table_len =

docs/CVE_METADATA.json

@@ -251,6 +251,15 @@
     "in_kev": false,
     "kev_date_added": ""
   },
+  {
+    "cve": "CVE-2025-32462",
+    "module_dir": "sudo_host_cve_2025_32462",
+    "cwe": "CWE-863",
+    "attack_technique": "T1068",
+    "attack_subtechnique": null,
+    "in_kev": false,
+    "kev_date_added": ""
+  },
   {
     "cve": "CVE-2025-32463",
     "module_dir": "sudo_chwoot_cve_2025_32463",
@@ -313,14 +322,5 @@
     "attack_subtechnique": null,
     "in_kev": false,
     "kev_date_added": ""
-  },
-  {
-    "cve": "CVE-2025-32462",
-    "module_dir": "sudo_host_cve_2025_32462",
-    "cwe": "CWE-863",
-    "attack_technique": "T1068",
-    "attack_subtechnique": null,
-    "in_kev": false,
-    "kev_date_added": ""
   }
 ]

docs/RELEASE_NOTES.md

@@ -29,6 +29,13 @@ rules into `/etc/audit` legitimately needs root.
   after disclosure, NVD had not yet classified it; it is now **CWE-269**
   (Improper Privilege Management).
 
+A third, latent cause kept the gate red even after those two: when
+`sudo_host` (CVE-2025-32462) was added in v0.9.8 its record was appended to
+the *end* of `CVE_METADATA.json`, but the drift check compares the record
+list in `discover_cves()`'s sorted order — so the out-of-order entry read
+as drift regardless of its values. Regenerating via the script restores
+sorted order.
+
 Refreshed `CVE_METADATA.json`, the generated `cve_metadata.c` table, and
 `KEV_CROSSREF.md` accordingly (README + website counts updated).