release v0.9.9: install.sh needs no sudo + CVE metadata drift fix

install.sh never escalates to sudo. The installer defaulted to
/usr/local/bin and fell back to `sudo mv`, prompting for a password on
exactly the unprivileged accounts a privilege-escalation tool targets. It
now uses /usr/local/bin only when already writable and otherwise installs
to a per-user $HOME/.local/bin (honoring XDG_BIN_HOME), no sudo ever. An
explicit SKELETONKEY_PREFIX is honored and errors rather than escalating.
The documented one-liner prepends ~/.local/bin to PATH so it resolves on a
fresh login, and the quickstart drops the misleading sudo from --scan /
--audit / --auto.

CVE metadata drift (the failing weekly drift-check):
  - CVE-2022-0492 (cgroup_release_agent) entered CISA KEV 2026-06-02;
    corpus now 13 of 36 modules cover KEV-listed CVEs.
  - CVE-2026-46333 (ptrace_pidfd) gained CWE-269 from NVD (was unclassified
    at module-add time).
Refreshed CVE_METADATA.json, generated cve_metadata.c, and KEV_CROSSREF.md;
README + website KEV counts and version bumped to 0.9.9.

docs/CVE_METADATA.json

@@ -122,8 +122,8 @@
     "cwe": "CWE-287",
     "attack_technique": "T1611",
     "attack_subtechnique": null,
-    "in_kev": false,
-    "kev_date_added": ""
+    "in_kev": true,
+    "kev_date_added": "2026-06-02"
   },
   {
     "cve": "CVE-2022-0847",
@@ -308,7 +308,7 @@
   {
     "cve": "CVE-2026-46333",
     "module_dir": "ptrace_pidfd_cve_2026_46333",
-    "cwe": null,
+    "cwe": "CWE-269",
     "attack_technique": "T1068",
     "attack_subtechnique": null,
     "in_kev": false,