Triage workflow + allow/deny-list scoring override

[richardmhope]

Proposal

• triage_status (new/triaging/accepted-risk/blocked/resolved) + assignee + notes on Extension.
• Allow-list / deny-list that overrides the heuristic score (approved → suppressed; blocked → forced critical), tied into the Phase 1 scoring-override hook.

Acceptance

• Allow-listed extension drops to suppressed; deny-listed forced critical; triage state persists.

---

From the PLAN.md roadmap to a SOC-consumable Marvin.