Declare once, apply to many: scoping VEX decisions without lying

A vulnerability scanner does not remember what you decided yesterday. Every build re-reports the same...