fix(docs): preserve evidence before malware remediation

skills/docs-generator/references/vendor-report-rules.md

@@ -85,7 +85,7 @@
 ### 3.4 核心发现（Findings 表或编号列表，挂 evidence_ids）
 
 ## 4. 应急处置方式
-（编号可执行步骤：断网 → 杀进程 → 清文件 → 查 hosts/启动项 → 全盘查杀 → 复核）
+（仅在授权范围内执行：先确认 scope 并保全样本、内存、进程树、网络连接和日志等证据，再隔离主机；经负责人批准后再终止进程、隔离/清除文件、检查 hosts/启动项、全盘查杀并复核。不得在证据保全前直接删除文件。）
 
 ## 5. 总结说明
 （给普通用户/运维的风险提醒与预防）

skills/scripts/verify-routing-coherence.ps1

@@ -182,6 +182,13 @@ Assert-Fields (Join-Path $skillsRoot 'pentest-tools/references\recon-pipeline.md
 Assert-Fields (Join-Path $skillsRoot 'docs-generator/references\security-report-templates.md') @('Evidence Chain', 'Findings', 'Path')
 Assert-Fields (Join-Path $skillsRoot 'field-journal/_template.md') @('Scope', 'Evidence', 'Finding')
 Assert-Fields (Join-Path $skillsRoot 'case-review/SKILL.md') @('ACTION REQUIRED', 'review_case.py', 'Evidence Graph Review')
+$vendorRulesPath = Join-Path $skillsRoot 'docs-generator/references\vendor-report-rules.md'
+$vendorRulesText = Get-Content $vendorRulesPath -Raw -Encoding UTF8
+if ($vendorRulesText -match '先确认 scope 并保全' -and $vendorRulesText -match '不得在证据保全前直接删除文件') {
+    Ok 'malware remediation preserves evidence before destructive actions'
+} else {
+    Bad 'malware remediation does not require evidence preservation before destructive actions'
+}
 $fieldLog | Set-Content -LiteralPath (Join-Path $ScratchDir 'template-fields.txt') -Encoding UTF8
 
 # --- role map skills exist for primary rows ---