Dependency Sweep

Fleet-wide CVE / outdated-dependency ledger. Read-only — the sweep CLI is the only writer.