feat: add versioned declarative detection rules

[jonathanhaaswriter]

Adds a strict CEL/YAML rule engine and connects its first versioned rules to ingestion without changing tenant storage ownership.

Detection behavior:

• evaluates versioned GitHub public-repository, Slack MFA, Slack external-shared-channel, and Google external-sharing rules;
• rejects unknown fields, invalid expressions, duplicate active rule IDs, and unsupported versions at load time;
• supports tenant disablement, bounded severity overrides, stable evidence-scoped dedupe, and tenant/integration-scoped auto-resolution;
• keeps the established evaluator as a fail-closed fallback when a pack or provider payload cannot be evaluated;
• adds opt-in GitHub deploy-key detection with write-key escalation and scope-sensitive Slack app severity;
• includes an in-memory backtest API, JSON schema, fixtures, parity coverage, and a concrete support matrix.

Validation:

• go test ./... -count=1
• go vet ./...
• go mod verify
• migration and worker-parity guardrails passed on the authored slice
• git diff --check

Known unsupported provider events are listed in docs/detection-support-matrix.md; this pull request does not claim coverage for events the connectors do not normalize.