v3.6.4: fix #33 — mode-aware grounding so white-box SAST findings aren't demoted

The grounding gate ran in empirical mode for every engagement, demoting
white-box (and skills/n8n audit) findings that had passed the n-model vote
because a file:line code citation isn't raw tool output. Grounding is now
mode-aware:
- Symbolic (white-box SAST / skills): a file:line reference into the reviewed
  source, or a quote of code present in it, is the receipt — no live target.
- Empirical (black-box / host / AI): evidence must resemble tool output (as before).
- Either (grey-box): a source citation OR a tool receipt grounds a finding.
The symbolic check runs against the reviewed source corpus (not the transcript)
and falls back to a structural file:line + quote check when the corpus is
unavailable. Adds unit tests incl. a regression test for #33.

TUTORIAL.md

@@ -1,4 +1,4 @@
-# NeuroSploit — Tutorial & User Guide (v3.6.3)
+# NeuroSploit — Tutorial & User Guide (v3.6.4)
 
 A complete, hands-on guide to installing, configuring and running NeuroSploit —
 the autonomous, multi-model penetration-testing harness.
@@ -98,7 +98,7 @@ Agents **degrade gracefully**: if `rustscan` is absent they use `nmap`; if neith
 ### Verify
 
 ```bash
-neurosploit --version          # neurosploit 3.6.3
+neurosploit --version          # neurosploit 3.6.4
 neurosploit agents             # {"vulns":196,...,"chains":12,"total":417}
 neurosploit models             # all providers & models
 ```
@@ -522,8 +522,10 @@ NeuroSploit treats the target as **partially observable** (a POMDP):
   entropy: when a node's belief is diffuse, recon is worth more than exploiting.
 - **Anti-hallucination gate** (`may_assert`) — the agent may **not** claim
   exploitability while the belief is diffuse; it must observe more first.
-- **Grounding** — **no claim without a tool receipt**: empirical for black-box
-  (real HTTP/OOB/error output), symbolic (`file:line`) for white-box. Ungrounded
+- **Grounding** — **no claim without a receipt**: *empirical* for black-box /
+  host / AI (real HTTP/OOB/error output), *symbolic* for white-box SAST & skills
+  audits (a `file:line` reference into the reviewed source — the code citation is
+  the receipt, no live target needed), and *either* for grey-box. Ungrounded
   claims are demoted and flagged.
 - **Chaining** — confirmed findings are chained into deeper impact, each stage
   proven before advancing.