fix: prevent minimum refresh timeouts and handle bulletin scan exits

[JordanNanos]

Changes

• Fetch the four independent Ubuntu package records concurrently, with a maximum of four workers. Preserve input order and propagate errors instead of returning partial results. Per-request timeouts and security validation are unchanged.
• Add opt-in request timing on stderr and enable it for the refresh step. Logs contain URLs and elapsed time, never request headers or credentials.
• Capture bulletin scanner exit codes inside a shell conditional. GitHub runs bash with errexit; the old command exited immediately on discovery code 3 and incorrectly reported a failed scan. Genuine failures still retry three times and fail the final gate.

Evidence

The diagnostic run recorded four Ubuntu requests taking about 60 seconds each. It then rebuilt all 12 components and passed the audit tests, but incorrectly failed on the new-bulletin exit code: https://github.com/SemiAnalysisAI/ClusterMAX/actions/runs/36090373993

Validation

• Local audit suite: 1,318 tests and 838 subtests passed.
• New regressions cover concurrent package resolution, error propagation, credential-free logging, and scanner exits 0, 2, and 3 under bash -e.
• Live repair run: https://github.com/SemiAnalysisAI/ClusterMAX/actions/runs/36091539492

No minimum-version data or advisory policy changes are included. Generated data remains separate in PR #26, including the newly detected AMD-SB-6034 bulletin for human review.

---

Note

Low Risk
CI and generator plumbing only; no minimum table or advisory policy changes. Parallel fetches and shell exit handling are covered by new tests.

Overview
Addresses minimum-versions refresh job timeouts and a bulletin-scan false failure under GitHub Actions’ bash -e.

Ubuntu package lookups in ubuntu_minimums now run in parallel (ThreadPoolExecutor, up to four workers) instead of sequentially, cutting wall time when each CVE/API call can take ~60s. Order and fail-closed behavior are unchanged: pool.map keeps package key order and still aborts the whole refresh on any package error.

Observability: Fetcher routes all HTTP through a _open helper that logs method, URL, and elapsed time at INFO (never headers or GITHUB_TOKEN). A new --verbose flag turns that on; the workflow refresh step uses python3 -u and --verbose for unbuffered CI logs.

Bulletin detection shell: The detect-new-bulletins step captures the Python exit code inside an if/else so expected exit 3 (untracked bulletin found) is handled as success for retry/found=true logic instead of errexit killing the script and mis-reporting a failed scan. Transient failures still retry three times.

New audit tests cover credential-free fetch logging, Ubuntu concurrency/error propagation, and exit codes 0/2/3 under bash -e against the workflow script.

^{Reviewed by Cursor Bugbot for commit 426b41c. Bugbot is set up for automated code reviews on this repo. Configure here.}