feat(cli): add manus-agent poc-freshness subcommand for PoC activity recency scoring

[manus-use]

Summary

Implements the manus-agent poc-freshness CLI subcommand, which was documented in the README (usage examples, flag table) but had zero implementation — no tool module, no CLI wiring.

What it does

poc-freshness measures how recently proof-of-concept (PoC) activity occurred for a given CVE, producing a 0–100 freshness score. A high score means attacker interest is ongoing or very recent.

manus-agent poc-freshness CVE-2024-3094
manus-agent poc-freshness CVE-2024-3094 --output json | jq .freshness_score

Signals examined (all public, best-effort):

Signal	What it measures
GitHub PoC repos	Last push recency, new repo creation, star count
trickest/cve index	Presence and density of indexed PoC URLs
Exploit-DB	Publication date of matching entries (via CSV index)
NVD references	Count of exploit-tagged references

Scoring algorithm

• Exponential decay function: activity today = 100, activity at half-life (60d) ≈ 50, asymptotic to 0
• Composite score: max signal as base + diminishing returns from additional signals
• Classification bands: CRITICAL (80+), HIGH (60+), MODERATE (40+), LOW (20+), MINIMAL (<20)

Files changed

• src/manus_agent/tools/poc_freshness.py — new tool module (~350 lines)
• src/manus_agent/cli.py — parser, runner, _SUBCOMMANDS, dispatch wiring (+100 lines)
• tests/test_cli_poc_freshness.py — 45 fully-mocked tests covering:
  • Decay scoring math
  • Date parsing edge cases
  • Each signal gatherer (GitHub, trickest, Exploit-DB, NVD) with mocked HTTP
  • Composite scoring algorithm (all classification bands, cap at 100, bonus signals)
  • CLI text and JSON output formats
  • Graceful degradation when all signals fail
  • Case-insensitive CVE input
  • Tool function direct invocation

Test results

1203 passed, 3 deselected, 3 warnings in 25.48s

(Baseline 1158 + 45 new = 1203, 0 failures)

Duplicate check

Confirmed NO overlap with existing open or merged PRs:

• PR feat(cli): add manus-agent exploit-search subcommand for unified exploit database search #127 (exploit-search) — different tool (searches exploit databases, not freshness scoring)
• PR feat(cli): add manus-agent poc-week subcommand for trending CVE digest #131 (poc-week) — different tool (weekly trending digest, not per-CVE freshness)
• PR feat(tools): get_poc_freshness — PoC freshness checker + CLI subcommand (+72 tests) #60 (merged, poc-freshness not in title — was search_poc_sources / poc-search)
• Scanned all 49 open PRs (feat(tools): CVE variant cluster analysis — cluster_cve_variants + manus-use cluster-variants CLI #67–feat(cli): add manus-agent sbom-scan subcommand for SBOM vulnerability scanning (+66 tests) #133) and 30 most recent merged PRs — none implement poc-freshness
• The README documents poc-freshness as a distinct subcommand separate from poc-search