feat: add cve-neighbors tool and CLI subcommand (+51 tests)

[manus-use]

Summary

Adds a new cve-neighbors tool and CLI subcommand that discovers other CVEs affecting the same product or package as a given CVE — the "neighborhood" of vulnerabilities you should patch together.

Motivation

When triaging or patching a single CVE in a library, you often want to know: are there other CVEs I should fix at the same time? Currently, users must manually search NVD or jump between tools. This tool automates that workflow.

How it works

1. Fetches the target CVE from NVD → extracts CPE (Common Platform Enumeration) vendor:product pairs
2. Searches NVD for other CVEs matching the same product keyword
3. Enriches neighbors with EPSS exploitation-probability scores from FIRST.org
4. Returns a prioritised list (highest EPSS first) with CVSS, publication date, and description

Usage

# Find CVEs related to the same product as Log4Shell
manus-agent cve-neighbors CVE-2021-44228

# JSON output with custom limit
manus-agent cve-neighbors CVE-2021-44228 --max-results 20 --output json

Example output

Found 3 neighboring CVE(s) for product 'apache:log4j' (from CVE-2021-44228):
  Target product: apache:log4j
  Ranked by EPSS exploitation probability (highest first).

   1. CVE-2021-45046  EPSS=0.5000  CVSS=9.0 (CRITICAL)  Published=2021-12-14
      DoS and RCE in Log4j2 via Thread Context Map lookups.

   2. CVE-2021-45105  EPSS=0.3000  CVSS=7.5 (HIGH)  Published=2021-12-18
      DoS in Log4j2 via recursive lookup patterns.

Implementation details

• Tool: src/manus_agent/tools/get_cve_neighbors.py
• CLI dispatch: added to _SUBCOMMANDS set and dispatch block in cli.py
• NVD retry/back-off: mirrors existing get_nvd_data conventions (exponential back-off, respects NVD_API_KEY, NVD_MAX_RETRIES, NVD_RETRY_BASE_DELAY)
• EPSS enrichment: batch fetch from FIRST.org API; gracefully degrades on failure

Test coverage (51 tests)

Category	Tests
Input validation	5
NVD fetch failures	4
CPE product extraction	6
CVSS extraction	5
Description extraction	4
EPSS batch fetch	4
Main tool (success paths)	8
NVD headers	3
CLI subcommand	5
Edge cases	7

All tests fully mocked — no real network access. Full suite passes: 1209 tests total.

Checklist

• New tool module: get_cve_neighbors.py
• CLI subcommand: manus-agent cve-neighbors
• Text and JSON output formats
• Comprehensive test suite (51 tests)
• All existing tests pass (1209 total)
• Follows project conventions (retry/backoff, tool_output_logger, argparse patterns)