Fix prohibited command table false positive

[LE0-Lin]

Summary

• avoid reporting a command repeated in a Markdown replacement table when nearby prose explicitly prohibits that same command
• retain detection for active dangerous commands in ordinary tables
• add the behavior across six instruction formats, expanding the adversarial suite to 134 contracts
• add Reaparr/Reaparr and olup/origan as pinned, manually reviewed external repository cases

Real-world reproduction

• Reaparr/Reaparr: B 89 false positive before; A 100 after
• olup/origan: docker-system-prune remains correctly active at B 88

Verification

• full unit suite: 130 passed
• adversarial benchmark: 134/134, 56/56 clean controls
• five-repository smoke benchmark: all reviewed expectations matched