Add a built-in incomplete-chain control scenario

[bsmensah-ctrl]

Problem

The current lab has a complete five-event classic scenario and a same-process cooperative control. A built-in incomplete-chain scenario would make the detector's correlation requirement easier to demonstrate from the CLI.

Proposed change

Add an incomplete synthetic scenario derived from the classic flow but missing remote_thread_start.

Acceptance criteria

• dll-injection-lab demo --scenario incomplete is accepted by the CLI.
• The scenario emits four deterministic events, all with synthetic=true.
• The detector returns zero findings.
• A public JSONL fixture matches the built-in scenario.
• Tests cover deterministic output and the zero-finding expectation.
• README or fixture documentation includes the command and expected result.
• The offline boundary remains unchanged: no process, network, or platform API access.

Useful starting points

• src/crossview_lab/simulator.py
• tests/test_simulator.py
• docs/DETECTION_GUIDE.md