fix(ignore): a cora-ignore marker with trailing text, or naming an unknown rule, silently suppresses nothing #679

Problem

cora-ignore: <rule>[, <rule>...] parses everything after the colon up to the end of the line as the comma-separated rule list. Natural explanatory text on the same line therefore becomes part of the (single) rule name, the marker matches nothing, the finding stays reported, and cora prints no warning. The same happens for a typo or an unknown rule id. The only symptom is that the suppression "does not work".

Reproduction (cora 0.19.0)

src/a.rs containing one line each (separate runs, cora scan --no-llm --format compact):

pub const ENV_API_KEY: &str = "TOLE_API_KEY"; // cora-ignore: sec-hardcoded-secret (an env var NAME, not a value)

-> [CRITICAL] src/a.rs:1: [sec-hardcoded-secret] still reported, nothing on stderr.

pub const ENV_API_KEY: &str = "TOLE_API_KEY"; // cora-ignore: no-such-rule-at-all

-> same finding, no warning.

pub const ENV_API_KEY: &str = "TOLE_API_KEY"; // cora-ignore: sec-hardcoded-secret

-> 0 findings. A preceding comment-only marker line with the explanation on its own line also works.

Why it matters

Suppressions are the escape hatch that keeps a quality gate usable. When one fails silently, people either assume the rule is wrong, or widen the suppression (ignore.rules) to something much broader than intended. Writing the reason next to the marker is exactly what reviewers ask for.

Proposal

1. Warn (stderr, and an unmatched_markers list in JSON / SARIF notifications) when a marker names no known rule id or finding title, or when it does not match any finding on its target line (so stale markers are found too). A --strict-markers flag could make that an error in CI.
2. Support an explicit reason separator, e.g. cora-ignore: rule-a, rule-b -- reason text (and/or # reason), where the reason is ignored by matching and kept in the report (suppressed_by, reason).
3. Document the "rest of the line is the rule list" behaviour in the Inline Suppression section.

Done when

• The first and second repro lines above produce a warning that names the unmatched token.
• // cora-ignore: sec-hardcoded-secret -- env var name suppresses the finding and the reason is visible in JSON output.
• Tests cover unknown rule, trailing text without separator, and the new separator.

Related (closed): #554, #597, #609.