refactor: honor suppression in the shared role-analysis path

[jier]

• analyze_role() gained apply_suppressions and now filters in one place, returning RoleAnalysis.suppressed.
• Single-role orchestrator reads the already-filtered result (dropped its inline block).
• scan collection and document role --collection now pass apply_suppressions=True → all three paths honor suppression identically (previously a suppressed finding still showed in scan/collection).
• 2 new parity tests (unit analyze_role + end-to-end scan collection).
• Single-role keeps role_path as base (correct for --role .), and I recorded the one residual honestly: absolute --role /abs/path single-role still resolves from the role dir, not cwd — a small follow-up, not a regression.