Update sandogasa to 0.19.1

Packaging changes: - manpages now shipped - /etc/${tool}/config.toml ghosted in case the user drops a config file there

v0.19.1

• Man pages for every tool — each of the 16 tools now ships a man page at tools/<tool>/man/<tool>.1, generated from its clap definition so the page and --help cannot disagree. One page per tool covers the whole CLI, with every subcommand as a subsection. A per-tool test fails if a page stops documenting a flag or falls behind the version, so drift is a test failure rather than something a reader discovers. The pages are committed and included in the published crates, so packagers can install them without building or running the binaries.

• A Makefile for discoverability — the workspace's checks were spread across scripts/ and a cargo alias. "make help" now lists them: "make check" runs what a pull request should pass, "make release-checks" adds the audit, semver and coverage gates, and "make man" regenerates the man pages. It is a task runner over cargo, not a build system.

• ebranch: karma voting understands review requests — check-update --give-karma decided per-bug feedback automatically only for release-monitoring bugs, whose summary carries a version to compare. A new package's Review Request bug has no version, so every one fell through to the interactive prompt. Review requests are now auto-voted +1 when the update builds the package under review; a review naming a package the update does not build is still put to the user rather than voted down.

• CONTRIBUTING.md and AGENTS.md — what a contribution needs (one identified issue, tests that pass offline, a signed-off commit) and how to disclose AI assistance with an Assisted-by trailer, following the Fedora AI-Assisted Contributions Policy and the kernel's guidance. AGENTS.md at the top level points any coding agent at the project's conventions.

New library surface: sandogasa_cli::man (behind an optional "man" feature) renders a clap Command as a man page, and sandogasa_bugclass::bugzilla::review_request_package extracts the package name from a Review Request summary.

Full details: https://github.com/slopfest/sandogasa/blob/v0.19.1/CHANGELOG.md#v0191

v0.19.0

• fedora-cve-triage: only run triages now (breaking CLI) — the six per-check subcommands are removed. run --check <name> does what each did, and per-check configuration under [check."<name>"] covers the scoping their separate configs provided. Migration: pass the query as flags, e.g. bodhi-check -f bodhi-check-salimma.toml becomes run --assignee michel@michel-slm.name --check bodhi-check, and --close-bugs becomes --apply. New --status overrides the config's statuses. The eight per-check configs are replaced by one maintainer-agnostic run.toml.

• fedora-cve-triage run — one command applies every classifier to one bug population, in order, the first check that claims a bug keeping it, so false positives are filtered before Bodhi is consulted and a misfiled branch is moved before its fix is looked for. One Bugzilla search and one NVD lookup now serve all six checks, which matters because NVD is rate limited to one request every six seconds -- each check used to search and cache separately.

• fedora-cve-triage: uniform per-bug review (breaking CLI) — --apply now reviews every bug the same way whichever check proposed it: keep performs the action, explain records a note on the bug, remove skips it. New -y accepts everything unreviewed and --claim reassigns without asking. Breaking: without a terminal and without -y nothing is written, where the false-positive checks used to close every detected bug unreviewed when piped.

• fedora-cve-triage: three accuracy fixes found by reading a real run — a bare "javascript" in a description no longer counts as evidence of the JavaScript ecosystem (javascript: URIs are the standard XSS payload, and that alone proposed closing a live Python CVE); unshipped-tools distinguishes "not shipped" from "cannot tell" and acts only on the former, since a spec that globs its binaries proves nothing; and both JS checks share one determination so neither is blind to a CVE that NVD has not analyzed.

• fedora-cve-triage: fix versions NVD does not have — a CVE still Awaiting Analysis carries no CPE data, so a fix that shipped weeks earlier went unnoticed. A fixed_versions table supplies one per CVE, and the advisories NVD links to are read for a "fixed in <version>" line, offered as a suggestion to confirm rather than acted on.

• fedora-cve-triage: --assignee, --skip-component, per-check narrowing, and a layered run profile — the run config can be shipped at /etc/fedora-cve-triage/run.toml and merged beneath the user's, so one packaged profile serves everybody.

• fesco-chair: summary announces late in-ticket votes, both emails wrap to 71 columns so a mail client does not rewrap them, and the wiki's new Council happenings slot appears in the agenda and the script. Decision tallies are matched case-insensitively and followup inference reads minutes topics that put the ticket number last.

• Library crates: sandogasa-config gains try_for_tool_file for layering a file other than config.toml; sandogasa-nvd exposes NVD's analysis state and reference URLs; sandogasa-distgit sends a User-Agent, the last client without one.

• Documentation: every tool's README now describes the system-wide config layer, with the packaging details in DEVELOPMENT.md, and fedora-cve-triage gains development notes recording the design a later check has to fit.

v0.18.2

• Workspace deduplication sweep — about 1,800 lines removed with no intended change in behavior, by moving repeated patterns into the shared crates; sandogasa-gitlab alone lost 20 copies of the same HTTP status check and four pagination loops, poi-tracker's commands return Result instead of hand-rolling the error-to-exit-code dance 39 times, and hs-relmon and cpu-sig-tracker dropped their pure-delegation GitLab wrappers
• sandogasa-cli — new confirm() for yes/no prompts, replacing about fifteen hand-rolled variants whose semantics had drifted apart; new optional http feature carrying the API clients' shared reqwest builders and uniform status handling; wrap_prefixed() moved in from ebranch
• fesco-chair summary announces late in-ticket votes — a ticket tagged pending-announcement after the schedule email went out previously got no announcement at all; it is now listed with the minutes, tally parsed from the ticket comments
• fesco-chair wraps both emails to 71 columns — meetbot's minutes run past 200 columns, and a mail client left to wrap them puts continuations flush left, losing the bullet structure; wrapping narrower than the client keeps the layout intact in the list archive
• fesco-chair gains the Council happenings slot — the wiki's new standing slot for the FESCo Council representative, in both the agenda announcement and the day-of meetbot script
• fesco-chair fixes — decision tallies match case-insensitively, so a lowercase "approved (+6, 0, 0)" is no longer missed; followup inference reads minutes topics that put the ticket number last
• fedora-review-digest run — drives fedora-review itself and flows the result into the digest, with --copr, --repo, --mock-config, --uniqueext and --mock-option for builds whose dependencies aren't in Rawhide yet
• koji-lag — completion windows are half-open, so a build completing exactly at midnight UTC belongs to one day rather than both
• Stale user agents fixed — sandogasa-gitlab and sandogasa-repology were announcing themselves as 0.6.2, and five other clients sent none at all

Full details: https://github.com/slopfest/sandogasa/blob/v0.18.2/CHANGELOG.md#v0182