v4.6.11

report_vulnerability now accepts an optional hypothesis_id: on a successful report the finding is linked to that ledger hypothesis (finding_ref evidence) and the hypothesis is marked proven, closing the precision finish-gate loop without a separate add_hypothesis_evidence call. Deterministic and best-effort (empty/unknown id = silent no-op). See CHANGELOG.md.