v3.15.0

• New AST/dataflow engine (TypeScript-compiler-backed, lazy): real intra-file dataflow the regex engine can't do
• VG406 is now dataflow-aware — it fires only when a route param actually flows into a DB sink (multi-hop, through assignments/query-builders), not just co-occurs with one. Validated: 24 to 20 findings, all 4 removed are confirmed false positives, 0 true positives lost
• Adds a runtime dependency (typescript: pure-JS, zero sub-deps, no native bindings); the README claim is updated to 'minimal, fully-audited runtime dependencies'. No rule or tool changes (442 / 37); gate green (PASS/A/0)