Add contextual prioritization signals (usage, reachability hints, exposure)

Background

Current output is lockfile-first and remediation-focused, which is useful for fast triage. Community feedback suggests adding context that helps teams prioritize findings based on likely impact in real workflows.

Goal

Add optional contextual prioritization signals (not definitive exploitability claims) to help teams prioritize dependency findings.

Scope (initial)

• Add optional usage signal: package appears in project imports/requires
• Add optional reachability hint signal: lightweight static/path heuristics where applicable
• Add optional exposure signal: simple indicators (for example, package appears in server/request-facing dependency paths)
• Include these signals in verbose/JSON output as prioritization context
• Keep vulnerability matching logic unchanged

Non-goals

• No claim of definitive exploitability
• No full runtime reachability engine
• No guarantee that not-used means not-exploitable

Acceptance criteria

• Context fields are clearly labeled as heuristic/prioritization signals
• Existing lockfile vulnerability detection remains unchanged
• Output language stays precise and avoids overclaiming
• Tests cover signal presence/absence and fallback behavior
• Docs updated minimally to explain scope and limitations

Start by tracing the existing lockfile vulnerability detection and verbose/JSON output paths. Define how usage, reachability-hint, and exposure signals are represented, including fallback behavior, while keeping matching unchanged. Add tests for signal presence and absence, then update the documentation with the heuristic limitations and verify precise output wording.