Simplify scan results with readable summary and matched-event CSV

VALIDATION.txt

@@ -5,9 +5,9 @@ validation environment. Synthetic path checks do not replace target-OS tests.
 
 CODE AUDIT
 
-134 tests passed with Python warnings treated as errors in 36.475 seconds.
-Strict mypy passed for 35 source files. Ruff lint and format checks passed for
-36 files. The enabled
+136 tests passed with Python warnings treated as errors in 37.031 seconds.
+Strict mypy passed for 37 source files. Ruff lint and format checks passed for
+38 files. The enabled
 lint families are E, F, I, UP, B, SIM, RUF and PERF; this is not a claim that every
 optional rule from every analyzer is enabled.
 
@@ -131,3 +131,12 @@ A subsequent Unicode literal-lookup guard has synthetic regression coverage,
 but the entire private fixture set was not rerun after that guard. These checks
 validate known examples and important negative cases, not zero false positives
 or complete detection of all future attacks. Private evidence is not shipped.
+
+CLI RESULT PRESENTATION
+
+CLI scans produce SUMMARY.txt, matched-event FINDINGS.csv and IOCS.csv at the
+result root. Complete machine-readable evidence is retained under details/;
+prepared inputs remain under inputs/. Tests cover separation of context from
+matches, preservation of JSON evidence, authorized-test labels, spreadsheet
+formula protection and no-matches wording. Direct engine.scan callers retain
+the flat layout. A synthetic CLI smoke check confirmed the new directory layout.