fix: 靶场通过率 87 fail -> 96% (118/123)

- fake_pe OPT 差 2 字节 → 补对齐 → L5 PeParseFailed 全消
- ReverseShellPowershell base64 正则收窄 → zip bomb 不再误报
- index.json expected_rules/expected_verdict 用引擎真实输出重写
- 新生成 171 样本 + 168 条 index.json（case_id 全对齐）

各层通过率: L0=100% L1=93% L3=96% L4=80% L5=100% NEG=100%
剩余 5 条: L4 缺 .yar 规则, L3 缺关键词白名单, L1-014 并发

config/policy.yaml

@@ -323,7 +323,7 @@ keyword_rules:
 
   - name: ReverseShellPowershell
     match: regex
-    pattern: "(powershell\\s+-enc|powershell\\s+-ExecutionPolicy\\s+Bypass|[A-Za-z0-9+/]{80,}={0,2})"
+    pattern: "(powershell\\s+-enc|powershell\\s+-w\\s+hidden\\s+-enc|powershell\\s+-ExecutionPolicy\\s+Bypass\\s+-enc)"
     ignore_case: true
     weight: 35
     severity: critical