A security manager at a fintech company is closing out a large backlog of Code Scanning alerts across 40 repositories. Several hundred alerts share the same CWE and originate from a deprecated internal library that is being fully removed next sprint. Leadership requires that any mass dismissal leave a clear, auditable record explaining the business justification, and that the alerts do NOT silently reappear if the deprecated code is temporarily reintroduced during the migration. Which approach best satisfies both the scale and the governance requirements?