Document CI validation flag 0x20 and add kernel probe

tests/README.md

@@ -21,3 +21,10 @@ The tests do not validate CI trust policy, asynchronous kernel I/O behavior, or
 general Authenticode hashing of unusual section layouts. The digest implementation
 still uses its existing linear byte-order convention and heuristic signature
 algorithm detection; replacing those requires a separate compatibility corpus.
+
+## File-object validation flag probe
+
+See [the flag documentation and VM procedure](../docs/ci-validate-file-object.md)
+for `CiValidateFileObject` flag `0x20`. Run `python tests\run-ci-probe-tests.py`
+from the same developer shell to test probe plumbing with mock CI. The kernel
+probe must still be run in a suitable VM to verify actual policy behavior.