feat(cli): add manus-agent cluster-variants subcommand for CVE variant clustering

[manus-use]

Summary

Implements the manus-agent cluster-variants CLI subcommand and the underlying cluster_variants tool module. This was explicitly documented in the README (usage examples, flag table, workflow section) but had zero implementation — no tool module, no CLI wiring.

What it does

Groups CVEs related to an input CVE across three cluster dimensions:

1. Same Component/Vendor — finds other CVEs affecting the same CPE vendor/product (e.g., other Apache Log4j vulns)
2. Same CWE Weakness Class — finds CVEs sharing the same weakness type (e.g., all CWE-917 Server-Side Template Injection vulns)
3. Same Researcher/Disclosure Source — finds CVEs reported by the same CNA/source organization

This is useful for mapping the full attack surface when one CVE is confirmed exploited — "if Log4Shell is in our environment, what else from the same component/weakness/researcher should we check?"

Usage

manus-agent cluster-variants CVE-2021-44228
manus-agent cluster-variants CVE-2021-44228 --output json | jq .clusters

Implementation details

• src/manus_agent/tools/cluster_variants.py (~370 lines): Tool module with NVD API queries across three dimensions, text rendering, and Strands SDK tool entry point
• src/manus_agent/cli.py (+55 lines): Parser, runner, _SUBCOMMANDS registration, and dispatch
• tests/test_cli_cluster_variants.py (51 tests): Comprehensive mocked test suite covering extraction helpers, fetch logic, main clustering, text rendering, Strands tool entry point, CLI text/json output, error handling, and edge cases

Test results

1209 passed, 3 deselected, 3 warnings in 25.57s

(Baseline 1158 + 51 new tests, 0 failures)

Duplicate check

Checked all 50 open PRs (#75–#135) and 30 most recent merged PRs — no existing open or merged PR implements cluster-variants. The closest PRs are:

• feat(tools): CVE side-by-side comparison — compare_cves tool + manus-use compare subcommand #48 (merged) compare_cves — side-by-side comparison of two specific CVEs, not clustering
• feat(tools): get_cve_timeline — CVE event timeline reconstructor + CLI subcommand (+88 tests) #129 cve-timeline — event timeline for a single CVE, not clustering
• feat: add OSV per-package CVE lookup to get_dependency_blast_radius #111 osv-package-cve-lookup — per-package CVE lookup in blast-radius, different purpose

None implement multi-dimensional CVE variant clustering.