Tighten AS3, EA1 and EA3 false-positive handling

[sholmes222]

Why

Reduce AS3, EA1, and EA3 false positives caused by inert source citations, defensive instructions, and the MIT warranty clause, without hiding operational directives.

What changed

• AS3 recognises a narrow, standalone GitHub SKILL.md citation pinned to its declared 40-character source revision. Regression tests retain findings for instruction pretexts and adjacent directives.
• EA1 recognises direct prohibitions on opening, reading, viewing, inspecting, or accessing a file, plus one narrowly defined wrapped prohibition that requires explicit approval before opening a local file.
• EA3 excludes only the exact MIT warranty clause. Broader scope-creep wording and adjacent instructions still produce findings.
• Adds SPDX-marked behavioural regression coverage for the accepted contexts and their adversarial neighbours.

Verification

• Focused pytest run: 84 passed.
• ruff passed.
• An independent 11-case adversarial packet passed, covering pinned citations, preceding source commands, licence headings after commands, double negation, conditional or adjacent destructive instructions, and scope creep.
• A full local CLI scan using --no-llm --fail-on-incomplete --fail-on-findings completed with 100% coverage and no exceptions.

Dependencies and merge order

None.

Related: #312 documents EA3 findings from licence boilerplate, and #652 documents false positives from prohibitive language. This change does not supersede other work on EA1 wildcard cases.