feat(sources): fetch linked URLs for the 252 spreadsheet-only cases

Until now only cases 357+ (plus a few older ones) had their linked URLs
fetched; the other 252 dossiers held just the text pasted into the
spreadsheet, often only the lede. This pass fetches every linked URL for
those cases so the full text is on file before link rot takes it.

- stage_all.py: new --include-sheet-cases flag that lifts the skip on
  cases holding spreadsheet articles. Resumable as before.
- staging/: raw extracts and index.json for the 252 cases.
- sourced-articles.json, case-files-manifest.json: 188 new UNTRIMMED
  blocks. 179 cases gained at least one fetched article; 73 got none
  (49 BLOCKED, 18 THIN, 9 DEAD, 4 video/social, 3 ERROR).
- sources/*.txt: rebuilt with build_cases.py --all. Sheet pastes are
  kept; fetched blocks sit beside them under the NOT YET TRIMMED banner.
  Files previously committed with CRLF are now LF.
- wayback-availability.json: Wayback snapshots exist for 73 of the 98
  failed URL slots; input for an archive-fetch pass.
- README-START-HERE.md: progress note and next step.

verify_all.py PASSES (1836 checks).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GZZENdTLzNGsbNy4DyF1yt

merge-output/staging/028/01_thehackernews-com.txt

@@ -0,0 +1,113 @@
+Yikes! Three armed men tried to rob a Bitcoin Exchange in Canada
+
+As many non-tech savvy people think that Bitcoin looks like a Gold coin as illustrated in many stock images, perhaps these robbers also planned to rob a cryptocurrency exchange thinking that way.
+
+All jokes apart, we saw one such attempt on Tuesday morning, when three men armed with handguns entered the offices of a Canadian Bitcoin exchange in Ottawa, and restrained four of its employees.
+
+The intruders then struck one of the employees in the head with a handgun, asking them to make an outbound transaction from the cryptocurrency exchange.
+
+A fifth employee in another cabin, who remained unseen in an office, called the police before any assets could be taken, and the robbers left empty-handed.
+
+One of the suspects arrested later Wednesday after arriving police officers saw him run into a ravine north of Colonnade Road and deployed "extensive resources," including K-9 unit officers, to find him, CBC News reports.
+
+"Police are looking for two additional suspects, both described as black males," the police says. "Investigators are also interested in identifying and speaking to a person of interest that was inside the premise as the suspects arrived. That person did not remain at the scene."
+
+The suspect in custody, identified as 19-year-old Jimmy St-Hilaire, has been charged with the following offences:
+
+Conspiracy to Commit an indictable offence
+
+Possess weapon for committing an offence
+
+St-Hilaire is set to appear in court on January 24, 2018. Ottawa police are now looking for the remaining two suspects.
+
+The authorities have not revealed the name of the cryptocurrency exchange.
+
+A similar incident happened last month when armed robbers kidnapped a top executive at UK-registered crypto-exchange EXMO Finance and allegedly stole more than $1.8 million of Ether for releasing him.
+
+The New York District Attorney's Office charged New Jersey native Louis Meza for the kidnapping and robbery, claiming Meza held "demanded that the victim turns over his cell phone, wallet, and keys while holding the victim at gunpoint."
+
+Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
+
+Bitcoin exchange, cryptocurrency exchange, Cyber Attack, hacking news, robbery
+
+Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
+
+⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
+
+Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data
+
+A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw
+
+Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
+
+Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users' Reservations in Tests
+
+CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing
+
+FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations
+
+New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access
+
+Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
+
+ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories
+
+Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
+
+OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Face
+
+Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
+
+PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions
+
+Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL
+
+Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
+
+Learn How to Build Security Operations Ready for AI-Powered Attacks
+
+Imagine the SOC Without a Queue: From Alert Backlog to AI Hypothesis Engine
+
+Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows
+
+Frontier AI: Vulnerability Management's Systemic Revolution
+
+Why AI Teams Need Verifiable Search Data Instead of Black-Box Signals
+
+Why Threat Intelligence Needs OT Context to Protect Critical Infrastructure
+
+See How Keeper Secrets Manager Removes Hard-Coded Credentials
+
+Download the CISO's Guide to Smarter AI Security Investment
+
+Phishing Is Costing Security Teams More Than Ever — Read the New Report
+
+Build AI Agents and Automations Without Losing Security Control
+
+AI Attacks Are Moving Faster.
+
+Watch: How to Prepare Your Security Program for AI-Powered Attacks
+
+AI can find and chain vulnerabilities in minutes. This session gives you a practical roadmap to strengthen visibility, response, and remediation.
+
+Learn How to Know What to Fix First Before AI Speeds Up the Attack
+
+Learn how to identify exploitable risk faster, prioritize what matters most, and reduce exposure before AI-powered attacks accelerate the threat.
+
+11 Real Stories: How Identity Exposure Unlocks Active Attack Paths
+
+Map cross-domain privilege escalation to sever breach routes at key choke points.
+
+SANS 2026 Security Awareness & Culture Report Shows What's Next
+
+11 years of practitioner data on what it takes to keep pace with a field that keeps shifting.
+
+Prevention Already Failed. What Does Your Monitoring Actually Catch?
+
+A 6-day SANS course rebuilds hybrid detection across cloud, endpoint, and network. GMON, Sept 21.
+
+The Missing Context Layer for AI Agents in Large Enterprise Codebases
+
+Shadow AI Is Now Hiding Inside Sanctioned AI Tools
+
+The EU CRA Will Make You Report What It Hasn't Yet Made You Fix

merge-output/staging/028/index.json

@@ -0,0 +1,16 @@
+[
+  {
+    "case": 28,
+    "n": 1,
+    "field": "url",
+    "url": "https://thehackernews.com/2018/01/cryptocurrency-exchange-robbery.html",
+    "host": "thehackernews.com",
+    "fetched_at": "2026-09-05T12:56:10+00:00",
+    "verdict": "FETCHED",
+    "method": "raw",
+    "http": 200,
+    "chars": 5584,
+    "sha256": "a94af51f351f01d2905dd69ce2ab078d982c1ab0b0bb0f8058c9550810db9e50",
+    "final_url": null
+  }
+]