Two opt-in triage passes, enabled with score.py --project <dir> (without it the score is unchanged).
Reachability-lite — an SCA finding whose package name never appears in your source is downgraded one severity step (declared-but-unused). Conservative by design: it never drops a finding, only downgrades on a confident zero-match — a CVE on a dependency you declare but never import weighs less than one you actually use.
.dsc-ignore — suppress accepted findings with a mandatory justification: <path-glob>:<ruleId-or-*> -- why. Suppressed findings are listed in the report with their reason (visible, never silent); a rule missing its justification is rejected, not applied.
Completes the v0.4.0 noise-reduction roadmap. Backward compatible.