Asset staging for Vuln Explorer Md.XI
- Record SHA256 hashes in the nearest README/CAPTURES document next to the asset entry (no separate manifest file).
- Subdirs: console, api, cli, ledger, telemetry, rbac, runbook, advisory, sbom, vex.
- Keep filenames deterministic and stable.