chore(release): v8.1.3 — install locations, both config dirs, case, watch cwd

Version 8.1.3 in package.json, .claude-plugin/plugin.json, README badge
and changelog list, CLAUDE.md header and highlights, CHANGELOG. No tag:
release-plugin.mjs is the operator's push round.

Also in this commit: file content no longer carries order IDs or
pointers into the local-only plan (comments and test names in the
own-working-tree, av-surface and watch-cron tests; `punkt N` -> `(N)`).
README's antivirus section now says v8.1.3 touched it.

Suite after `git add`: 2344 tests, 2338 pass, 0 fail, 6 skipped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -6,7 +6,7 @@ Check skills, plugins and MCP servers before they run with your agent's permissi
 
 *AI-generated: all code produced by Claude Code through dialog-driven development. Every change is human-directed, reviewed, and validated before commit. Per Anthropic Consumer Terms §4, ownership of outputs is assigned to the user; this plugin is licensed MIT.*
 
-![Version](https://img.shields.io/badge/version-8.1.2-blue)
+![Version](https://img.shields.io/badge/version-8.1.3-blue)
 ![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple)
 ![Scanners](https://img.shields.io/badge/scanners-22-cyan)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
@@ -95,7 +95,7 @@ Every report command also writes a self-contained HTML version and prints a link
 
 ## For teams and CI
 
-- **Policy as code** — `.llm-security/policy.json` travels with the repository: hook modes, thresholds, audit log path. A scanned *foreign* repository's own policy and ignore file are not applied, so it cannot suppress its findings. Known exceptions — a tarball or `git archive` export under your working directory, a Python venv, a `vendor/` folder — are listed under 8.1.2 in the changelog.
+- **Policy as code** — `.llm-security/policy.json` travels with the repository: hook modes, thresholds, audit log path. A scanned *foreign* repository's own policy and ignore file are not applied, so it cannot suppress its findings. Known exceptions — a tarball or `git archive` export under your working directory — are listed under 8.1.3 in the changelog.
 - **Runs without Claude Code** — `node bin/llm-security.mjs scan <target>` (also `deep-scan`, `posture`, `ide-scan`, `audit-bom`, `benchmark`); no API key needed. It is **not** air-gapped: OSV.dev lookups (package names and versions), `npm audit`/`pip-audit`, and DNS checks on URLs it finds reach the network, with no switch to turn them off. Block egress at the network layer if you need an offline run.
 - **CI gates** — `--fail-on <severity>` exit codes, `--compact` output, SARIF 2.1.0. Templates for GitHub Actions, Azure DevOps and GitLab CI in [`ci/`](ci/); guide in [`docs/ci-cd-guide.md`](docs/ci-cd-guide.md).
 - **Evidence** — JSONL audit trail with OWASP tags for your SIEM, CycloneDX 1.6 AI bill of materials, and posture checks mapped to EU AI Act, NIST AI RMF and ISO 42001.
@@ -106,9 +106,9 @@ This is a security tool. It ships regular expressions for known-bad code, knowle
 
 What still sits on disk as readable text, and is therefore the likeliest to be flagged: the regex signature tables in `scanners/commons/` (some name hacking tools as plain words), the attack descriptions in `knowledge/`, and the injection phrases and sample commands the examples feed to the hooks.
 
-### What v8.0 → v8.1.2 did about it
+### What v8.0 → v8.1.3 did about it
 
-All antivirus work landed in **v8.1.0**; v8.1.1 and v8.1.2 did not touch it. (v8.0.0 moved the detection tables, including the malware signatures, into the vendored `scanners/commons/` data that ships with the plugin.)
+Most antivirus work landed in **v8.1.0**; v8.1.1 and v8.1.2 did not touch it, and v8.1.3 removed three runnable base64-to-shell lines whose blobs were too short for the gate, and extended the gate to catch them. (v8.0.0 moved the detection tables, including the malware signatures, into the vendored `scanners/commons/` data that ships with the plugin.)
 
 | Change (v8.1.0) | Effect |
 |-----------------|--------|
@@ -209,6 +209,7 @@ Move each one into `.llm-security/policy.json`:
 
 ## Changelog
 
+- **8.1.3** (2026-09-23) — Python venvs, `vendor/` folders and Claude Code skills count as foreign; both config directories are checked; letter case no longer decides; `/security watch` as a cron job applies the watched project's own ignore and policy files.
 - **8.1.2** (2026-09-22) — Installed packages (`node_modules`) and Claude Code's plugin directory count as foreign, so their ignore and policy files are not applied.
 - **8.1.1** (2026-09-22) — A clone, submodule or worktree *under* your working directory counts as foreign.
 - **8.1.0** (2026-09-22) — Antivirus surface (see above); a scanned foreign repository's own ignore and policy files are no longer applied.