Summary

• Add reachability/VEX context to vulnerability triage so non-exploitable or not-affected findings can be tracked appropriately.
• Replace substring-style license guidance with SPDX expression/exception parsing and distributed-vs-dev scoping.
• Expand manifest coverage for pyproject.toml, NuGet, Composer, Ruby, Dart, and Elixir ecosystems.
• Add lockfile drift, git/URL/tarball dependency, resolved install-script, EPSS percentile, and KEV-absence guidance.

Validation

• git diff --check
• Local frontmatter check using the repository workflow required fields
• Local prompt-injection scan using the repository workflow patterns

Closes #1143

Bounty

Improver contribution. Preferred payment method can be provided privately after acceptance.