fix(cve-alerts): allow a major bump when it is the only fix

The triage prompt told Claude to change nothing when the only fix was
a new major version. Now Claude picks the lowest fixed release of the
lowest major that has one, and starts the note with "MAJOR bump" so the
reviewer checks for breaking changes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E2K27DFf4J3iAGXYpe4xtR

.github/prompts/cve-fix.md

@@ -20,8 +20,11 @@ their own update jobs.
 
 - From the OSV records, find the version that fixes each advisory. Pick one
   exact version that fixes all of them: the lowest release at or above every
-  fixed version, on the major line of the newest pin in the repo. If the fix
-  needs a new major version, change nothing and say so in the note.
+  fixed version, on the major line of the newest pin in the repo.
+- When no fixed version exists on that major line, a new major version is the
+  only fix. Then pick the lowest fixed release of the lowest major that has
+  one, never higher. Start the note with "MAJOR bump" and name the old and
+  new versions, so the reviewer checks for breaking changes.
 - Put every pin of the package in the repo on that exact version, including
   pins the audit did not flag, so the whole repo runs one version. Find them
   with the Grep tool: `"<package>": "` in `package.json` files for npm, and
@@ -47,8 +50,7 @@ production deployment.
 
 Write `$NOTE_FILE` in Markdown for the reviewer: three to six short sentences.
 Say what you searched, what you found, and whether Onyx is affected. If you
-changed nothing, say why (no fix released, needs a major version, OS package,
-or GitHub Action).
+changed nothing, say why (no fix released, OS package, or GitHub Action).
 Use plain words, and no headings.
 
 Write `$RESULT_FILE` as JSON with exactly these keys: