v0.5.0 — reachability + secret verification

See cli/CHANGELOG.md in the source repo. Adds import-level dep-CVE reachability annotation, --verify / --only-verified for live-secret detection (10 providers), and closes ~700 FPs of ignore-rule parity gaps on the secret scanner. CI gate (--fail-on=verified-high) is the tightest level available.