v1.4.0

Added in 1.4.0

• Evidence-backed confirmed, needs_validation, and rejected finding verdicts with baseline
  carry-forward, Markdown grouping, and SARIF review states.
• Published schemas for findings reports, scan plans, and evidence runs, plus a stdlib validator and
  automatic normalized-report validation.
• Guidance for using deterministic scanner evidence before a complementary logic-level audit.