Dismissal propagation: fetch dismissed_issues from /context, mark findings, exclude from score

[thomasboni]

The platform half shipped (2026-09-07): /context now serves dismissed_issues and the push contract accepts an optional dismissed boolean on findings. This issue is the CLI half.

What the CLI does

1. Fetch: ProjectContext.dismissed_issues - array of {identity_hash, recipe_version, control_type}, always present ([] when none), capped at 1000 (newest dismissals first). An entry whose recipe_version differs from the local recipe version is SKIPPED (versions never mix; unmatched dismissal = honest non-suppression).
2. Match: for each finding, compute the identity via the shared finding/identity recipe (currently v4 - the same recipe the platform uses to build issues from findings). control_type is a cheap pre-filter before hashing.
3. Mark, never omit: a matched finding stays IN the results with dismissed: true. Omitting it would make the platform flip the issue to Fixed - a dismissal masquerading as a fix.
4. Score: ComputePlumberScore excludes dismissed-marked findings from the denominator, like not_evaluable (zero points, out of the denominator - NOT counted as pass; an org must not be able to dismiss its way to 100).
5. Display: plumber analyze output shows the finding as dismissed (visible, not failing, not scored).

Sequencing (no flag day)

The platform accepts the marker forward-tolerantly today but its score recompute still counts marked fails: the platform's CLI pin bump adopting the new ComputePlumberScore ships WITH the release that closes this issue. Until then CLI-printed and platform scores can diverge on dismissals - the platform's divergence WARN already anticipates this.

Notes

• The finding-status enum (pass|fail|not_evaluable) is frozen; dismissed is an orthogonal boolean.
• The marker is a CLAIM about what /context served - the platform's own issue status stays the sole authority (a raced un-dismissal is handled platform-side; no CLI special-casing).
• A dismissal suppresses the same finding on every branch (identity is branch-blind, intended).
• Old CLIs are unaffected (they ignore dismissed_issues and never send the marker).