Sort the findings tables newest disclosure first

[p80n-sec]

The published findings tables rendered in load_findings' key order, which reads as arbitrary. CVE ids sort lexically, so CVE-2026-27959 sat at the bottom of the table despite being disclosed two months after every other record — an identifier assigned early can outrank one disclosed much later.

Change

Adds records.published_newest_first(findings): filters to status: published and sorts by disclosed descending. Both renderers now route through it, which also removes the duplicated status filter each was carrying inline.

The sort is stable, so same-day disclosures keep the key order they arrived in. Without that, the three findings sharing 2025-12-22 could shuffle between runs and churn the README diff.

load_findings still returns key order — that remains the canonical order for detail pages and duplicate detection. Only the tables re-sort.

Result

CVE-2026-27959  2026-02-26
CVE-2025-63662  2025-12-22
CVE-2025-63663  2025-12-22   <- tie, key order preserved
CVE-2025-63664  2025-12-22
CVE-2025-63665  2025-12-19

Identical ordering in the HTML table.

Verification

• pytest -q — 150 passed (145 before, 5 new)
• The 5 new tests were written first and confirmed failing against the old ordering
• generate --today 2026-08-14 — exit 0; generate --check — exit 0
• Idempotent: a second generate produces a byte-identical README

Tests added

Test	Pins
test_published_newest_first_orders_by_disclosure_date	date descending, not key order
test_published_newest_first_breaks_ties_on_key	stability on same-day disclosures
test_published_newest_first_drops_unpublished_records	in-progress records stay out
test_published_table_lists_newest_disclosure_first	README table order
test_index_published_table_lists_newest_disclosure_first	HTML table order

Not changed

• The pending table still renders in key order. Its natural sort is probably soonest-deadline-first, but that wasn't asked for and is a separate call.
• sort.js is untouched — this is the server-rendered default order. Clicking a column header still re-sorts client-side as before, and no header starts with an aria-sort indicator.

🤖 Generated with Claude Code