#3772 cve/emudhra page: Windows and macOS support, and shared CVE layer fixes (follow-up to #3710 and #3766)

Summary

Follow-up to #3710 and #3766. The swamp-club page /cve/emudhra (swamp-club PR 1393) is wired to @swamp/cve/emudhra 2026.10.21.1, which covers Linux only. #3766 ships 2026.10.22.1 with macOS and Windows targets, scans from a Windows machine, and Windows and macOS mitigation. Update the page once that version is published.

Copy to change (routes/cve/emudhra.tsx)

1. Section 03 (Install Swamp) says the extension "checks a Linux host or container" and ends "Scan Linux hosts from a Linux or macOS machine." It now checks Linux, macOS and Windows hosts, and swamp can run on Windows. From Windows it scans Linux and macOS over SSH, and Windows only locally.
2. Section 01 (Am I affected?) lists a Mac whose tools read /etc/ssl/cert.pem. The scanner now covers macOS: the Security framework verdict, plus /etc/ssl/cert.pem and Homebrew bundles. Add a Windows line: the CryptoAPI verdict and Microsoft's disallowed list.
3. Sections 04 and 06 (scanFleet, mitigate): SSH only, no WinRM. New global argument targetOs (auto by default). mitigate now refuses unknown SSH host keys, so run scan first. Windows mitigate needs an elevated administrator session or saves a .ps1. macOS mitigate saves a script to run locally. Re-run every command on the page against the published version in a scratch repo.
4. Section 05 copies the README's sample scan table verbatim (SCAN_OUTPUT). Recopy it if the published README's sample changes.
5. The summary logs are now fleet-summary and mitigate-summary (they were fleet-log and mitigate-log).
6. Keep the "TLS · code signing" badge and the lib/app/cve-advisories.ts scope in sync.

UI warnings on the shared layer (components/cve/CvePrimitives.tsx; the UI review rated both medium)

1. Every CveOutput has aria-label="Sample output", so /cve/dirtyfrag has two regions with the same name. Give CveOutput a label prop.
2. The default CveTitle uses whitespace-nowrap at text-4xl, so a longer title without compact overflows at 375px. Drop nowrap below sm:, or make compact the default.

Timeline

1. The 2026-10-27 entry (Chrome's removal of the emSign root reaching all devices) is future tense. Make it past tense after that date.

Gate

deno task check, tests/routes/cve_pages_test.tsx, tests/seo/seo_test.ts (the description must stay 150-160 characters), a 375px overflow check, and the page's commands re-run against the published extension.