Add AV false-positive guidance for issue #100, move inline YARA rule to references/yara-fileless-powershell.yar, and replace literal encoded PowerShell payload with a placeholder in the sample report.
