docs(ci): re-verify Group A interpreter CVEs on 3.14 and re-point waivers at #98

[tyler-rich]

Summary

Re-verifies the two Group A CPython interpreter-binary waivers in ci/grype.yaml against the
runtime the image actually pins (3.14.6), and gives them a tracking reference that matches that
runtime. Configuration and documentation only — no application code.

Group B (CVE-2025-15366 / CVE-2025-15367) is untouched.

Verification

Checked at the source per CLAUDE.md § Dependency hygiene — the 3.14 branch and the v3.14.6
tag were fetched and diffed, not read off Grype's FIXED IN column (which still says 3.15.x for
both):

CVE	Fix on 3.14 branch	In v3.14.6	Backport
CVE-2026-15308 (HIGH)	yes — buffered feed() / _parse_threshold in Lib/html/parser.py	no	python/cpython#153039, 07efb08, 2026-07-04
CVE-2026-12003 (MEDIUM)	yes — BUILD_LANDMARK fallback removed from Modules/getpath.py	no	python/cpython#151682, b93d6d3, 2026-06-22

Include/patchlevel.h on the 3.14 branch reads PY_VERSION "3.14.6+"; there is no v3.14.7 tag
and no Misc/NEWS.d/3.14.7.rst. 3.14.6 (released 2026-06-10) is the latest 3.14.x and both
backports merged after it, so 3.14.7 is the first release carrying either fix. Both waivers
stand and the 2026-10-25 review date is unchanged.

What changed

ci/grype.yaml

• Group A gains the dated source-verification note, names 3.14.7 as the concrete trigger, and
  cites new issue Group A CPython interpreter CVEs on 3.14 — accepted risk until the next 3.14.x point release #98.
• The shared header no longer points all four CVEs at a single tracking issue. Group A and Group B
  have different triggers and different trackers; one blanket "Tracked in issue CVE-2025-15367 (poplib) — accepted risk on any interpreter below 3.15 #52" line is what
  let the Group A reference go stale behind a Group-B-shaped issue.

docs/ARCHIVE.md

• Dated §14 entry (2026-07-26) with the full verification record.

Two scoping premises that did not hold

Recorded here and in the §14 entry rather than papered over:

1. The Group A comment was expected to still say "next 3.13.x." It already said "next 3.14.x" —
   the 2026-07-25 upgrade entry had retargeted it. No trigger correction was needed, so none was
   made; what the block was actually missing was the named release and any record of the fixes
   having been verified rather than assumed.
2. Issue CVE-2025-15367 (poplib) — accepted risk on any interpreter below 3.15 #52 was expected to be closed. It is open (the repository has no closed issues at all).
   Group A CPython interpreter CVEs on 3.14 — accepted risk until the next 3.14.x point release #98 was opened on the ground that does hold — CVE-2025-15367 (poplib) — accepted risk on any interpreter below 3.15 #52 is the older all-four tracker, written against
   the 3.13 runtime and stale since the move, including a resolution-trigger line asserting that
   3.14.6 carries the Group B fixes, which §14 (2026-07-25) records as false. The waiver comment
   says Group A CPython interpreter CVEs on 3.14 — accepted risk until the next 3.14.x point release #98 supersedes CVE-2025-15367 (poplib) — accepted risk on any interpreter below 3.15 #52 for Group A and notes CVE-2025-15367 (poplib) — accepted risk on any interpreter below 3.15 #52 is still open; it does not claim CVE-2025-15367 (poplib) — accepted risk on any interpreter below 3.15 #52 is
   closed. Whether to close or re-scope CVE-2025-15367 (poplib) — accepted risk on any interpreter below 3.15 #52 is left to you.

See docs/ARCHIVE.md § Deviations (2026-07-26) for the full record.

Closes nothing; tracks #98.