[SizzleUnrlsd]

Summary

The correlation engine of docs/architecture.md §27, the differentiator the document calls out: a vulnerable dependency, an affected API, a reachable call and attacker-controlled data reaching it become one high-confidence finding.

• Acceptance tests first (test: define correlation engine behavior), implementation follows.
• TaintKind.ADVISORY: the affected APIs of every advisory whose package is required in a vulnerable version are registered as sinks of this kind, through ModelTable.extended, which merges kinds when a symbol is already a sink. The shared taint engine, the interprocedural summaries and the refutation engine then apply unchanged.
• dependency/correlation.py: affected_symbols, advisory_sinks and correlate, a pure function turning the non-refuted ADVISORY flows of a function into exploitable-vulnerability findings (critical; high confidence, medium for hotspots) with the advisory, the package, the API, the source label, the verdict evidence and, across functions or files, the function the flow went through and the sink line.
• engine.analyze_project extends the model table with the advisory sinks and correlates every analysed function after the module plugins ran. A lone file has no dependency context and no correlation.
• Advisory sinks carry only the ADVISORY kind, so the generic detectors stay silent on them; an API that is also a regular sink keeps its own kinds.

Example: pyyaml==5.3.1 required, parse in config.py calling yaml.load, and a Flask route passing request.args["doc"] to parse yields a critical exploitable-vulnerability at the route's call line, through app.config.parse.

Closes #39