docs(php2shell): use the npx command form in examples (#504)

docs/exp-php2shell-testing.md

@@ -33,7 +33,7 @@ Each PHP image was run at its default configuration with no php.ini overrides un
 
 Two test passes were run against every target:
 
-1. **CLI binary.** The shipped `shannon start --exp-php2shell` command, using all available signals (crash detection and version headers).
+1. **CLI binary.** The shipped `npx @keygraph/shannon start --exp-php2shell` command, using all available signals (crash detection and version headers).
 2. **Crash-only harness.** A direct module harness that strips `X-Powered-By` and `Server` headers from the control response before classification, forcing the classifier to rely solely on the crash signal.
 
 ### CLI Binary Results

docs/exp-php2shell.md

@@ -13,7 +13,7 @@ The `--exp-php2shell` flag tests CVE-2026-109618, the first php2shell CVE: a PHP
 Upgrade PHP first, then run the probe against a staging or local deployment to confirm the fix landed:
 
 ```
-shannon start --exp-php2shell -u https://staging.example.com
+npx @keygraph/shannon start --exp-php2shell -u https://staging.example.com
 ```
 
 Before sending anything, the probe shows a confirmation prompt, because it will crash one PHP worker on the target.