Add toc and include all findings in the report

README.md

@@ -36,6 +36,20 @@ report_generator from-folder --artifacts ./sample [--path <file-or-directory>]
 `metadata.json`, so an export names its own run. Pass it for a folder assembled by hand, or one
 whose metadata is gone.
 
+The inputs are one SARIF file (`merged.sarif`, with one run per tool) and the vulnerability report
+(`vdr.json`); either is enough on its own. `metadata.json` is optional, and without it the scan and
+project pages are left out. The report has these parts:
+
+1. the cover and a table of contents,
+2. a summary and the most critical issues across all sources,
+3. one section per SARIF run, named after its tool (e.g. CipherCell SAST, CipherCell Lynkeus),
+4. the dependency vulnerabilities from the VDR,
+5. at the end, *False Positives and Suppressed Findings*: every result Polygraph classified as a
+   false positive or that carries a SARIF suppression (such as the areas Lynkeus ruled out), with
+   the reason.
+
+Every finding is listed; only the summary charts and the most-critical table are capped.
+
 The two produce the same document. Everything after the artifacts are in hand is shared code, and
 the sample export in `sample/` was checked against the report built from the store for the same
 scan: 17 of 17 pages identical. The tests cover the folder path; comparing the two needs a store