fix: reduce Windows Defender false positive on fileless malware skill

Add AV false-positive guidance for issue #100, move inline YARA rule to
references/yara-fileless-powershell.yar, and replace literal encoded
PowerShell payload with a placeholder in the sample report.

skills/detecting-fileless-malware-techniques/references/yara-fileless-powershell.yar

@@ -0,0 +1,13 @@
+// YARA rule for Volatility yarascan — fileless PowerShell indicators in memory.
+// Stored separately from SKILL.md to reduce antivirus false positives on the skill file.
+// See GitHub issue #100.
+
+rule Fileless_PowerShell {
+    strings:
+        $s1 = "System.Reflection.Assembly" ascii wide
+        $s2 = "[System.Convert]::FromBase64String" ascii wide
+        $s3 = "Invoke-Expression" ascii wide
+        $s4 = "DownloadString" ascii wide
+    condition:
+        2 of them
+}