feat(cli): add manus-agent vendor-response subcommand for vendor patch status tracking

[manus-use]

Summary

Wire up the README-documented manus-agent vendor-response CLI subcommand that was missing from the actual CLI implementation. This connects the existing track_vendor_response tool function to a proper CLI entry point with text and JSON output modes.

What it does

manus-agent vendor-response CVE-2024-3094
manus-agent vendor-response CVE-2024-3094 --output json | jq .vendor_response_state

Queries NVD references, CISA KEV, and VulnCheck KEV to produce a 6-state vendor patch/response classification:

• patch_available — confirmed fix released
• patch_pending — vendor acknowledged, fix in progress
• workaround_only — mitigation published, no patch yet
• investigating — vendor acknowledged, status unclear
• no_patch_expected — won't-fix / EoL / disputed
• unknown — insufficient data

Output includes confidence score (0–1), evidence list, and signal summary (NVD ref count, CISA KEV hit, VulnCheck KEV hit, API key presence).

Changes

• src/manus_agent/cli.py: Added _build_vendor_response_parser(), _render_vendor_response_text(), _run_vendor_response(), registered "vendor-response" in _SUBCOMMANDS set, and wired dispatch in main()
• tests/test_cli_vendor_response.py: 60 fully-mocked tests covering parser validation, text rendering for all 6 states, confidence label thresholds, signal display, evidence rendering, JSON output schema, CVE ID validation/normalization, integration with _classify internals, error handling, and edge cases

Test results

1218 passed, 3 deselected, 3 warnings in 25.58s

(Baseline 1158 + 60 new, 0 failures)

Duplicate check

Confirmed NO overlap with existing open PRs:

• test(tools): comprehensive test suite for track_vendor_response (+67 tests) #137 — tests for track_vendor_response tool function (not CLI wiring)
• feat(cli): add verify-exploit subcommand #146 — verify-exploit CLI (different subcommand)
• feat(cli): add manus-agent silent-patches subcommand for silent patch detection #138 — silent-patches CLI (different subcommand)
• feat(cli): add manus-agent cluster-variants subcommand for CVE variant clustering #136 — cluster-variants CLI (different subcommand)
• feat(tools): temporal_priority — temporal urgency scorer + CLI subcommand (+68 tests) #135 — temporal-priority CLI (different subcommand)
• feat(cli): add manus-agent poc-freshness subcommand for PoC activity recency scoring #134 — poc-freshness CLI (different subcommand)
• feat(cli): add manus-agent sbom-scan subcommand for SBOM vulnerability scanning (+66 tests) #133 — sbom-scan CLI (different subcommand)

No open or merged PR implements the vendor-response CLI subcommand.

Motivation

The vendor-response subcommand is documented in README but was never actually wired into the CLI dispatcher. This PR closes that gap, making the tool accessible via the command line as documented.