v3.11.0

• The audit dependency section now prioritizes findings: severity first, then imported (reachable) packages ahead of unused ones — fix what your code actually calls into first
• Severity is never changed (unreachable deps can still be exploitable), so no false negatives; each dependency finding now carries a structured reachable field
• No rule or tool changes (441 / 37); gate green (PASS/A/0). Completes S3-1.