v0.19.0 — suppressed-findings disclosure

Score reports now disclose inline-suppressed findings. Inline ' pumllint: disable comments exclude findings from scoring; every report now says so instead of staying silent. Text renders 100/100 (3 suppressed) plus a model-set total, HTML appends "N finding(s) suppressed inline", and the sonar message carries it — all only when non-zero, so clean output is unchanged. JSON always emits maturity.suppressedCount per diagram and for the model set, and the field is required in the score schema — consumers validating score reports should regenerate via pumllint schema score. Composite scores and levels are untouched; suppression semantics are now specified in SCORING.md §3, and --no-suppressions remains the full audit path.

Also in this release:

• The repository's own config moved from pumllint.yaml to pumllint.toml (stdlib-parseable), fixing the dependency-free CI jobs; YAML configs remain fully supported for consumers.
• Dogfooding docs: a sequence diagram of pumllint's own lint pipeline (docs/pumllint-lint-flow.puml) and the sense-vs-nonsense evaluation whose findings became this release (docs/dogfooding.md).