v3.4.0

• Dependency scan now annotates each vulnerable package with reachability: is it actually imported in your source? Turns daily CVE intel into a prioritized signal — a flagged dependency you never import drops down the list
• Annotate, never suppress: findings are labeled reachable true/false but nothing is dropped (transitive/dynamic use stays visible), so no new false negatives
• Surfaced in scan_dependencies and the audit dependency section; no rule or tool changes (438 / 37); gate green (PASS/A/0)