Goodware corpus

A goodware corpus gathers legitimate files representative of the environment where rules will run: operating-system binaries from several versions, common applications and installers, drivers, documents and scripts. Scanning it with a new rule should produce no matches; every hit is a false positive to fix.

Keep the corpus under version control and add each false positive you encounter, as described in testing and CI.