feat(cve-tool): run CVE-record operations through the configured CVE tool

.pre-commit-config.yaml

@@ -352,7 +352,7 @@ repos:
         name: check-family-plugins (marketplace plugins vs frontmatter)
         language: system
         entry: python3 tools/dev/check-family-plugins.py --fix
-        files: ^(tools/(agent-guard/src/.*|vetted-ops/(src/.*|hooks/.*|pyproject\.toml|README\.md))|tools/(jira|local-tracker|security-management|skill-lock|pr-management|typed-decision|release-config|release-management|release-verify|reproducible-archive|contributor-metrics|permission-audit|privacy-llm/redactor|github-body-field|github-rollup|vcs|cve-tool-vulnogram/(generate-cve-json|oauth-api)|privacy-llm/checker|asf-security-dash|gmail/oauth-draft)/(src/.*|hooks/.*|pyproject\.toml|README\.md)|tools/forwarder-relay/README\.md|tools/gmail/asf-relay\.md|tools/security-tracker-stats-dashboard/[^/]+|tools/security-tracker-stats-dashboard/src/.*|tools/dev/check-family-plugins\.py|\.pre-commit-config\.yaml|skills/.*/SKILL\.md|plugins/.*|\.claude-plugin/(marketplace|plugin)\.json|\.codex-plugin/plugin\.json|\.agents/plugins/marketplace\.json|(plugin|marketplace)\.json|apm\.yml|pyproject\.toml)$
+        files: ^(tools/(agent-guard/src/.*|vetted-ops/(src/.*|hooks/.*|pyproject\.toml|README\.md))|tools/(jira|local-tracker|security-management|skill-lock|pr-management|typed-decision|release-config|release-management|release-verify|reproducible-archive|contributor-metrics|permission-audit|privacy-llm/redactor|github-body-field|github-rollup|vcs|cve-tool|cve-tool-vulnogram/(generate-cve-json|oauth-api)|privacy-llm/checker|asf-security-dash|gmail/oauth-draft)/(src/.*|hooks/.*|pyproject\.toml|README\.md)|tools/forwarder-relay/README\.md|tools/gmail/asf-relay\.md|tools/security-tracker-stats-dashboard/[^/]+|tools/security-tracker-stats-dashboard/src/.*|tools/dev/check-family-plugins\.py|\.pre-commit-config\.yaml|skills/.*/SKILL\.md|plugins/.*|\.claude-plugin/(marketplace|plugin)\.json|\.codex-plugin/plugin\.json|\.agents/plugins/marketplace\.json|(plugin|marketplace)\.json|apm\.yml|pyproject\.toml)$
         pass_filenames: false
   # Claude Code mods — `claude plugin validate --strict` and `claude plugin
   # test` on every plugin whose `hooks/hooks.json` declares `modules`

docs/labels-and-capabilities.md

@@ -331,7 +331,7 @@ or a contract-free mix of substrates (e.g. `tools/spec-inventory` is
 | [`tools/asf-svn`](../tools/asf-svn/) | `contract:source-control` | ASF SVN tool adapter: source-control binding for `svn.apache.org` working copies (centralized model), `svn` CLI operation catalogue, `dist.apache.org` release-distribution helpers (stage/promote/prune), ASF committer/PMC authorization, and optional svnpubsub site publishing. The SVN counterpart to `tools/github/` for ASF projects. Also the `land` delegate for the `jira-patch` and `mail-patch` change-request backends (`svn patch` + `svn commit`) |
 | [`tools/change-request`](../tools/change-request/) | `contract:change-request` | Adapter contract for the proposed-change review + merge gate (pull request / merge request / patch). Pure interface spec; no executable code — backends under `tools/github/` (PR), `tools/jira-patch/`, and `tools/mail-patch/` implement it. The seam that lets `pr-management-*` skills run on non-GitHub backends |
 | [`tools/cve-org`](../tools/cve-org/) | `contract:cve-authority` | CVE.org services adapter: publishes records to CVE.org and reads back the resulting CVE state. Implements the `tools/cve-tool/` contract for the CVE.org-direct backend |
-| [`tools/cve-tool`](../tools/cve-tool/) | `contract:cve-authority` | Adapter contract for CNA backends (Vulnogram, MITRE form, CVE.org direct, GHSA). Pure interface spec; no executable code — adapters under sibling `tools/cve-tool-*/` directories implement it. |
+| [`tools/cve-tool`](../tools/cve-tool/) | `contract:cve-authority` | Adapter contract for CNA backends (Vulnogram, MITRE form, CVE.org direct, GHSA), and the `cve-tool` command the skills run: it reads `cve_authority.tool` and dispatches to that backend's adapter, over the sibling `tools/cve-tool-*/` directories. |
 | [`tools/cve-tool-vulnogram`](../tools/cve-tool-vulnogram/) | `contract:cve-authority` | ASF Vulnogram CVE-allocation adapter. Implements the `tools/cve-tool/` contract. Previously named `tools/vulnogram/`. |
 | [`tools/dashboard-generator`](../tools/dashboard-generator/) | `substrate:analytics` | Self-contained HTML dashboard generator |
 | [`tools/dev`](../tools/dev/) | `substrate:framework-dev` | Framework dev-loop helpers |

docs/security/process.md

@@ -474,8 +474,8 @@ one pass sync:
    signal that the advisory has shipped. The exact wire
    mechanism depends on the adapter (`cve_authority.publication_propagation`
    declares whether sync `poll`s for the result, awaits a
-   `webhook`, or treats the move as `manual`); for the
-   Vulnogram adapter the implementation is
+   `webhook`, or treats the move as `manual`); sync runs
+   `cve-tool publish`, which for the Vulnogram adapter calls
    [`vulnogram-api-record-publish`](../../tools/cve-tool-vulnogram/oauth-api/README.md)
    under `poll`.
 7. Moves the project-board column to `Announced`.