fix(malware-scan): scan committed vendor/, dist/ and build/ folders

[Satendra-SR]

Summary

The scanner skipped every path under vendor/, dist/ and build/ in all modes, including tracked files, --all-branches, and the CI workflow. This hid a live payload in SankalpTaru-Foundation/sankalptaru-website:

public/wp-content/plugins/seo-by-rank-math-pro/vendor/wp-media/plugin-family/webpack.config.js

It's the same campaign as the other files (global.o= marker, _$_a291 identifiers, char-127 decoder) and is present on 33 branches, including develop and main.

Change

• Git modes (default, --staged, --all-branches) now scan every tracked path. A committed vendor/, dist/ or build/ folder is as attacker-writable as src/.
• On-disk walk (--path, used by the local sweep) still skips untracked install and cache folders (node_modules, .next, .nuxt, coverage, .venv/venv, __pycache__, .turbo, .cache), but no longer skips vendor/, dist/ or build/.
• malware-scan/README.md updated to match.

Lockfiles, *.map and *.min.js are still skipped in every mode (unchanged).

Verification (text-only; no project code executed)

Repo	Before (tracked)	After (tracked)
sankalptaru-website	4 high	10 high (new file caught)
sankalptaru-huge	6 high	6 high
sankalptaru-mobile	6 high	6 high
sankalptaru-web	0 high	0 high
engineering-recipes	0 high	0 high

An independent grep over each full checkout, with nothing skipped, finds the same four infected files and nothing else.

After merge

• Pin consumer workflows to the new main SHA, not 91a9f2f, which has this gap.
• Anyone who installed the cc-malware-scan skill must re-run the install block to get the fixed scanner.
• main is still unprotected with no CODEOWNERS. Please have a second person review this PR before merging.

🤖 Generated with Claude Code

[Satendra-SR]

Added the vendor, dist, build and other folders under scan