Threat prioritization engine — single Go binary, deploy in 60 seconds. Pull-all, filter-local architecture with MISP + KEV sources.