Validate result views on real evidence and expose file-hash matches

src/netscaler_triage/presentation.py

@@ -76,6 +76,7 @@ def present_results(output: Path, summary: dict[str, Any]) -> None:
         f"Processing status: {summary.get('status', 'unknown')}",
         f"Records read: {stats.get('records', 0)}",
         f"Events matching a rule or indicator: {counts['matches']}",
+        f"Original-file SHA-256 indicator matches: {stats.get('file_hash_hits', 0)}",
         f"Matching events including an authorized-test indicator: {counts['authorized_test']}",
         f"Update/version records: {stats.get('update_records', 0)}",
         "",
@@ -86,6 +87,7 @@ def present_results(output: Path, summary: dict[str, Any]) -> None:
         "2. IOCS.csv — search candidates for SIEM; not an automatic blocklist.",
         "3. details/ — full JSON events, decoding, update records, correlations and checksums.",
         "   details/findings.jsonl also retains context and processing-error events.",
+        "   File-hash matches are in details/file_hash_hits.json, separate from event matches.",
         "",
         "HOW TO INTERPRET THIS",
         "",