Moves proof-or-kill-verified false positives (.env.example placeholder;
no-write-token detector fixtures) from machine-level to a tracked repo-local
.security-review/suppressions.json so the Open SWE daily-report automation
resolves them (it cannot see ~/.config on the Mac). Justifications sanitized to
avoid reproducing trigger strings. Machine-level copy retained until merge.
