Rewrite SAF-T1001 from cited research

[fkautz]

Summary

• fully rewrites SAF-T1001 from a claim-level evidence packet
• narrows the technique to top-level MCP tool descriptions and separates schema poisoning, runtime injection, shadowing, rug pulls, and delivery
• classifies the evidence as Demonstrated rather than Observed
• replaces the obsolete Process Injection mapping with MITRE ATLAS AML.T0110.000 and qualifies ATT&CK T1195.001 as delivery-only
• rebuilds the detection analytic and test corpus, including Unicode boundaries and an expected false positive
• preserves every existing Frederick Kautz version-history credit and credits all named research authors

Validation

• /Users/fkautz/anaconda3/bin/python3 techniques/SAF-T1001/test_detection_rule.py — 12/12 passed; 8 alerts, 4 non-alerts
• /Users/fkautz/anaconda3/bin/python3 scripts/validate-technique-research.py SAF-T1001 — passed
• /Users/fkautz/anaconda3/bin/python3 -m pytest scripts/test_new_technique.py scripts/test_validate_technique_research.py -q — 4 passed
• git diff --check — passed

Dependency

This PR is stacked on #223 because the technique uses the research workflow and template introduced there. Merge #223 first, then rebase this branch before final review.