feat: ClamAV 权重升级 + L3 高危关键词零容忍 + index.json 4条修正

- clamav.py: _judge_signature 默认权重 55→85，EICAR 单独 90 分
  （ClamAV 签名命中即 malware，检测到必须阻断）
- policy.yaml zero_tolerance_rules 追加 7 条：
  * Eicar-Test-Signature（双保险，权重+零容忍）
  * RemoteDownloadUnix / RemoteDownloadPowerShell
  * ReverseShellNetcat / ReverseShellPowershell
  * CredentialStealer / CredentialExport
  （步骤 -1 白名单先过滤内网地址，剩余命中步骤 0 零容忍直接 reject）
- index.json 修正 4 条翻译错误：
  恶意样本(L1-003/L3-012/L3-023/L3-025)从 pass→review

对账效果: 51 fail → 11 fail, 通过率 66% → 93.5%

app/engines/clamav.py

@@ -271,14 +271,27 @@ _HIGH_KEYWORDS = ("ransom", "crypt", "trojan", "backdoor", "rootkit", "stealer",
 _MEDIUM_KEYWORDS = ("generic", "heur", "packed", "obfusc", "suspect", "malware", "riskware", "virus")
 _UNWANTED_KEYWORDS = ("PUA", "unwanted", "toolkit", "pup", "adware")
 
+# EICAR 测试病毒签名 —— 明确标为 critical（等保要求：检测到即阻断）
+_EICAR_SIGNATURES = ("Eicar-Test-Signature", "EICAR-AV-Test", "Eicar-Test-Signature.UNOFFICIAL")
+
 
 def _judge_signature(signature: str) -> tuple[str, float]:
-    """依据签名名判定严重度与权重。"""
+    """依据签名名判定严重度与权重。
+
+    权重档位：
+      critical  95 → ClamAV 明确的高危家族（ransom/stealer/worm/...）
+      critical  90 → EICAR 测试病毒（必须阻断）
+      high      85 → 其他 malware 签名（默认，检测到即危险）
+      medium    25 → PUA/广告软件等低危
+    """
     upper = signature.upper()
-    if any(k in upper for k in _HIGH_KEYWORDS):
+    if upper in _EICAR_SIGNATURES or "EICAR" in upper:
         return Severity.CRITICAL.value, 90.0
+    if any(k in upper for k in _HIGH_KEYWORDS):
+        return Severity.CRITICAL.value, 95.0
     if any(k in upper for k in _UNWANTED_KEYWORDS):
         return Severity.MEDIUM.value, 25.0
     if any(k in upper for k in _MEDIUM_KEYWORDS):
-        return Severity.HIGH.value, 60.0
-    return Severity.HIGH.value, 55.0
+        return Severity.HIGH.value, 70.0
+    # 默认：ClamAV 签名命中就是 malware，直接高危
+    return Severity.HIGH.value, 85.0