Add SAF detection coverage registry

[fkautz]

Summary

• add a canonical detection mapping registry for all 80 active Framework Model v2 techniques
• classify native analytics by normalized observation modality and conservatively mark all current mappings as partial
• generate a human-readable coverage matrix that keeps semantic mapping, validation maturity, and external ownership separate
• add an external provider contract and record the existing Agent Threat Rules mapping as pending reconciliation rather than verified coverage
• validate active/deprecated lifecycle, rule and fixture links, provider metadata, external mapping status, and generated output in CI
• replace the stale hand-maintained mitigation table with a generated 51-document catalog, removing broken nonexistent entries including SAF-M-44

Current findings

• 80/80 active techniques have a native fixture-tested analytic
• 0 native mappings are represented as production-effective or complete; all 80 are classified as partial
• static analysis is the only normalized modality with zero native mappings
• 0 external rules are counted as validated until current rule IDs and current SAF targets are reconciled

Validation

• python3 -m unittest discover -s scripts -p "test_*.py"
• python3 scripts/validate-technique-research.py --all
• python3 scripts/validate-framework-model.py
• python3 scripts/generate-technique-catalog.py --check
• python3 scripts/validate-detection-registry.py
• python3 scripts/generate-detection-coverage.py --check
• python3 scripts/generate-mitigation-catalog.py --check

Closes #207.
Addresses #221, #188, #189, and #222.