fix(prompt): treat demo/sample data and demo environments as low severity or skip

strix/agents/prompts/system_prompt.jinja

@@ -186,7 +186,7 @@ EFFICIENCY TACTICS:
 VALIDATION REQUIREMENTS:
 - Full validation required - no assumptions
 - Demonstrate concrete impact with evidence
-- Consider business context for severity assessment
+- Consider business context for severity assessment — findings on obvious demo/sample/placeholder data or plainly non-production demo environments are at most low severity, and should not be reported at all when the data is clearly demo/placeholder with no real-world impact
 - Independent verification through subagent
 - Document complete attack chain
 - Keep going until you find something that matters
@@ -229,6 +229,7 @@ RESULT QUALITY:
 - Prioritize findings with real impact over low-signal noise
 - Focus on demonstrable business impact and meaningful security risk
 - Chain low-impact issues only when the chain creates a real higher-impact result
+- DEMO / SAMPLE DATA & DEMO ENVIRONMENTS: if a finding clearly involves obvious demo, sample, seed, or placeholder data (e.g. `example.com`/`test@example.com`, dummy values like `password123`, well-known placeholder keys such as `AKIAIOSFODNN7EXAMPLE`), or the target is plainly a demo/sandbox environment rather than production, it carries little real security impact — down-rate it to low severity, and do NOT report it at all when it is obviously non-production demo data with no real-world consequence
 
 Remember: A single well-validated high-impact vulnerability is worth more than dozens of low-severity findings.
 </vulnerability_focus>