Give the README a banner and cut it back to the useful parts

The README opened on a bare heading and five year tables, said nothing about
what the project is, and never linked the site. Anyone landing on the repo had
to guess. It now leads with a generated banner carrying the live index totals,
a badge row, and tables trimmed to what fits a table cell.

hero.py draws the banner and the social card as self-contained SVG, since
GitHub proxies README images and drops anything the file has to fetch for
itself. It counts the corpus through build_site's own parser rather than a
second guess at what counts as a PoC, so the banner cannot drift from the site
header, and leaves the figures in docs/stats.json for the README build to
quote. If the count fails it falls back to the deployed site and, failing
that, writes nothing at all: a banner reading zero is worse than yesterday's.

Badges describing the index are baked in at build time so they always match
the banner and cannot degrade to "resource not found"; the two that describe
live GitHub state carry a stamp that defeats the image proxy cache.

The sweep now runs hourly instead of every six hours. It takes under two
minutes and the repository shows up in "recently updated" far more often.

Also adds the OpenGraph tags the site never had, so a shared link renders a
card instead of a bare URL.

.github/workflows/hot_cves.yml

@@ -3,7 +3,7 @@ name: Hot CVEs List
 on:
   workflow_dispatch:
   schedule:
-    - cron: '0 */6 * * *'
+    - cron: '7 * * * *'
 
 permissions:
   contents: write
@@ -24,6 +24,16 @@ jobs:
         with:
           python-version: '3.13'
 
+      - name: Redraw the banner and recount the index
+        run: |
+          # Counts the corpus with the site build's own parser, so the banner can
+          # never disagree with the site, and drops the figures in docs/stats.json
+          # for the README badges to quote.
+          python3 .github/hero.py
+          # og:image has to be a raster: Twitter, Slack and Discord all ignore SVG
+          sudo apt-get install -y --no-install-recommends librsvg2-bin >/dev/null
+          rsvg-convert -w 1280 -h 640 docs/social-card.svg -o docs/social-card.png
+
       - name: Rebuild the trending PoC table
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -33,7 +43,7 @@ jobs:
         run: |
           git config user.name 'CVE-BOT'
           git config user.email '[email protected]'
-          git add -- README.md trending.json
+          git add -- README.md trending.json docs/hero.svg docs/social-card.svg docs/social-card.png docs/stats.json
           if git diff --cached --quiet; then
             echo "No changes to commit"
             exit 0