[ajianaz]

What

ignore.rules entries can now be objects, backwards compatible with plain strings:

ignore:
  rules:
    - "Hardcoded password or secret"          # whole project, unchanged
    - rule: bug-println
      files: ["crates/cli/**", "evals/**"]    # only these paths
      reason: "stdout is the cli interface"   # optional, documentation

• rule is matched like a plain entry (rule id or title fragment); files uses the ignore.files glob syntax.
• Applied in review, scan and the MCP tools, before the max_findings cap.
• An empty files list (or an empty rule) is a config error instead of a rule that applies nowhere.
• Docs (configuration.md, new section) and CHANGELOG updated.

Why

A rule can be noise in one crate and a real design guard in another (bug-println in a CLI vs an embedder-safe core); today the only options are silencing it everywhere or excluding directories from every check. Closes #680.

Testing

• Unit tests: a scoped rule is silenced only under its globs, plain strings still silence everywhere, **/file.rs globs.
• Config tests: YAML with strings and scoped objects (with reason) loads; empty files fails validation.
• 2 end-to-end tests (tests/scoped_ignore.rs): silenced in crates/cli, still fires in crates/core; plain form unchanged.
• fmt, clippy -D warnings and the full suite pass.