feat(core): inline suppressions — bypass/exclude/include checks from the code

Inline skip comments (#tirith:skip=<policy-id>: reason) are the adoption pattern users expect
from existing scanners. Two forms: a
suppressions file (policy id + resource address + required reason + optional expiry), which
works today because it filters on meta.address from the plan; and the in-code comment form,
which plan JSON cannot carry and therefore waits on an HCL source provider (Research). Suppressed
findings must appear in the verdict as suppressed-with-reason — never as a silent pass — and pack
coverage claims must count them.

Acceptance. A suppressed failing policy exits green with the suppression listed in every output
format; a suppression without a reason is a validation error; expiry turns it back into a failure.

Start by tracing the existing suppressions-file filtering on plan JSON and meta.address, then investigate the proposed HCL source provider needed for inline comments. Verify that suppressed findings appear with their reasons in every output format, that missing reasons fail validation, that expired suppressions fail again, and that pack coverage includes suppressed findings.