docs: Add benign-lookalike tuning matrix table

[Muhira7799]

What changed

Describe the user-visible behavior and why it belongs in DLL Injection Lab.

Verification

• pytest
• ruff check .
• ruff format --check .
• New or changed report output is schema-valid
• The package remains offline-artifact-only

Evidence

Include sanitized fixtures or output excerpts. Do not attach live host data,
credentials, private paths, or unredacted command lines.

Added the benign-lookalike tuning matrix table to docs/DETECTION_GUIDE.md covering all five synthetic actions.

Closes #2

[bsmensah-ctrl]

Thanks for taking this on. The matrix covers the right analyst-tuning problem, but three action names do not match the simulator's actual event model and the matrix currently interrupts the Five correlated signals section.

Please make these changes:

• Remote thread context write -> Remote memory write
• Remote thread execution -> Remote thread start
• Unbacked memory execution -> Module image load
• Move the entire Benign-lookalike Tuning Matrix below the five numbered signal sections so the document hierarchy remains intact.

After those edits and a passing CI run, this should be ready for another review.

[bsmensah-ctrl]

Thanks for contributing the tuning matrix. I applied a follow-up in b937fa2 to align the three remaining row names with the simulator's actual event model and place the table after the five-signal walkthrough. The contributor-provided matrix remains the basis of the section, and the locked verification run is green: 35 tests, Ruff checks, and formatting.