docs: replace illustrative reports with reproducible scan proof

[Synvoya]

Summary

• replace three illustrative reports containing stale or unsupported findings with one scanner-derived v0.3.1 fixture report
• record the exact engine and Trivy database versions, all 18 normalized findings, deduplication, and expected CVE drift
• put reproducible proof and a direct Star CTA near the top of the README
• replace the stale contribution wishlist with five live, scoped good first issue links

Verification

• npm run build — passed on public v0.3.1
• npx tsx scripts/dev-scan.ts fixtures/vulnerable-app — 18 normalized findings: 4 critical, 8 high, 5 medium, 1 low; all four engines ran
• git diff --check — passed
• report table contains exactly 18 finding rows
• all newly referenced local paths exist
• public and development copies of the report are byte-identical

Review note

The removed reports were illustrative and included rule IDs or detection capabilities that no longer matched the shipped scanner. The replacement is tied to a committed fixture and states what may drift.