BLT: NetGuardian — Zero-trust finding ingestion, CVE-aware triage, and verified events

NetGuardian is a zero-trust ingestion and triage pipeline that connects distributed security producers to BLT. A Cloudflare Python Worker sits at the center of it all: it verifies signed `ztr-finding-1` envelopes using JCS and HMAC, enforces replay protection and RBAC, stores metadata in D1, keeps encrypted evidence in R2, and enriches findings through BLT-API for CVE-aware scoring and issue creation. An events outbox handles delivery to any downstream consumers. The Worker also serves a static triage UI where operators can review verified findings and kick off fix workflows, either through PRs or BLT issue paths. On the deliverables side: versioned ingestion and triage APIs with a full OpenAPI contract, the end-to-end swarm dataflow with evidence storage, observability and rollout gates with SLOs, and a midterm slice to validate performance and correctness before the project is fully built out.