fix(security-cve-allocate): strip ID parentheticals anywhere in the title

[potiuk]

Summary

The Step 2 title-strip cascade anchors every identifier parenthetical to end-of-string with $. A title carrying one mid-string keeps it — and the cascade reports no change, so the parenthetical ships verbatim into containers.cna.title on the published CVE record:

Path traversal (incomplete fix for CVE-2026-12345) in the parser

Splits the cascade into patterns_anywhere (the four identifier-bearing parentheticals — GHSA, ZDRES/HUNTR/GHSL, split from #N, prior-CVE — now unanchored) and patterns_trailing (the genuinely position-dependent ones).

Motivation

Nothing in the rationale for stripping these depends on position. A prior-CVE reference belongs in the public summary's cross-CVE clause; a tracker ID belongs in the credits or issue body; a split from #N marker belongs in the tracker. None belong in the title, wherever they sit.

The failure mode is quiet, which is what makes it worth fixing: a changed=no from the cascade currently reads as "the title is clean", and a downstream adopter hit exactly that — a mid-title prior-CVE parenthetical that only surfaced in a manual review after allocation.

Design notes

• Over-stripping risk stays low: every unanchored pattern requires a well-formed tracker ID inside the parentheses.
• The reporter (<name> follow-up) paren stays end-anchored on purpose — its name part is loose enough that stripping it mid-title could eat a substantive clause.
• The cascade's existing re.sub(r"\s+", " ", t) collapse already closes the gap a mid-string removal leaves behind; no new whitespace handling needed.
• The title-normalization.md template is updated in lock-step. It was also missing the prior-CVE pattern entirely, so that is added.

Test plan

Ran the reworked cascade against 10 title shapes — 10/10 pass:

• mid-title (incomplete fix for CVE-…), (GHSA-…), (ZDRES-…), (split from #N) — all now stripped
• trailing forms of the same — still stripped
• multiple CVE parentheticals in one title — fixpoint loop handles both
• Race condition (Evan Ricafort follow-up) in the scheduler — deliberately not stripped
• Improper validation of the (optional) callback parameter — not stripped (no over-strip)

prek run --files passes on all three files, including markdownlint, check-placeholders, skill-and-tool-validate, and the in-hook lychee.

Note: this touches security-issue-sync/gather.md (one line, fixing the "trailing-only" wording), as does #1124 (a different row). Different lines, so they should auto-merge.

🤖 Generated with Claude Code