docs(readme): true self-scan number, AV false-positive section, demo form

.llm-security-ignore: MEM/SIG/UNI rules added only for by-design
findings, one explaining line each — the vendored conformance corpus,
the Cyrillic confusables in injection-patterns.mjs and the homoglyph
test inputs, the changelog's quoted homoglyph, the grade-F posture
fixture, and the miner names in the supply-chain blocklist. Not
suppressed on purpose: MEM on CLAUDE.md (the file a poisoning would
target) and AST/TRG (no by-design findings once the ast-scan fixtures
left the disk). Header prefix list completed (14 scanners) and the
"150" replaced by the measured count.

Self-scan, fresh clone of HEAD (node scanners/scan-orchestrator.mjs):
  before: BLOCK 80/100, 77 findings (1C 9H 29M 2L 36I), 362 suppressed
  after:  WARNING 61/100, 58 findings (0C 5H 15M 2L 36I), 381 suppressed
  without the ignore file: BLOCK 95/100, 439 findings (unchanged)
On `.` (working tree incl. local-only files): BLOCK 80/100, 80
findings -> WARNING 64/100, 61 findings.

README:
- Self-scan: the measured numbers replace "0 findings (ALLOW)".
- The demo commands materialize the tree to a temp dir (the form the
  demo README uses); no evil-project-health/ path left in README.
- New "Antivirus false positives" section + TOC entry: what the repo
  contains, why a classifier can still flag it, restore from
  quarantine, Microsoft's submission form, Microsoft's own advice
  against exclusions, a sparse-checkout recipe. Every Defender claim
  checked against learn.microsoft.com; the recipe run live against
  Forgejo (partial clone supported; 285 of 677 files on disk). The
  meaning of "!ml" is not claimed — Microsoft documents "!" suffixes
  only as internal indicators.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.llm-security-ignore

@@ -1,6 +1,6 @@
 # .llm-security-ignore — Suppress expected findings when scanning this plugin
 #
-# Why 150 suppressed findings? A security plugin that documents attack patterns,
+# Why 381 suppressed findings? A security plugin that documents attack patterns,
 # ships a malicious demo fixture, and tests against deliberately evil code will
 # trigger its own scanners. This is the "scanning the scanner" paradox:
 #
@@ -9,10 +9,12 @@
 # - tests/ contain deliberate taint flows and suspicious URLs as test input
 # - hooks/ and scanners/ contain high-entropy regex for secret detection
 #
-# Every suppression below is explained. Run without this file to see all 150.
+# Every suppression below is explained. Run without this file to see all of them.
+# Measured 2026-09-22 (v8.1.0) on a fresh clone: 439 findings without this file,
+# 58 with it (381 suppressed).
 #
 # Format: SCANNER:glob or just glob (applies to all scanners)
-# Scanners: UNI, ENT, PRM, DEP, TNT, GIT, NET, TFA
+# Scanners: UNI, ENT, PRM, DEP, TNT, GIT, NET, MEM, SCR, WFL, TRG, SIG, AST, TFA
 
 # Demo fixture: intentionally malicious (the whole point of the demo)
 examples/**
@@ -65,3 +67,24 @@ NET:CLAUDE.md
 
 # Baseline files: generated JSON with scan results (high entropy expected)
 reports/baselines/**
+
+# Unicode: the vendored commons conformance corpus carries homoglyph and zero-width inputs on purpose
+UNI:scanners/commons/conformance/**
+
+# Unicode: Cyrillic confusables are detection patterns here (the lexicon matches the homoglyph form)
+UNI:scanners/lib/injection-patterns.mjs
+
+# Unicode: homoglyph test inputs for the string-utils folding tests
+UNI:tests/lib/string-utils-homoglyph.test.mjs
+
+# Unicode: the changelog quotes the homoglyph form a fix detects
+UNI:CHANGELOG.md
+
+# Memory: the grade-F posture fixture is poisoned on purpose (that is what grade F tests)
+MEM:tests/fixtures/posture-scan/grade-f-project/**
+
+# Signature: the supply-chain blocklist names miner packages so the install hook can block them
+SIG:scanners/lib/supply-chain-data.mjs
+
+# Not suppressed on purpose: MEM findings on CLAUDE.md (it documents the hooks, but it is the
+# file a poisoning would target), and AST/TRG, which have no by-design findings here.