fix: chain TechVault Suricata Wazuh rules off built-in parents

[Brad-Edwards]

Summary

TechVault Wazuh rule 303020 ("Web attack (network)") never fired. Rule 303000 declared a rival decoded_as json parent. Wazuh binds each JSON event to one decoded_as parent, and the built-in 86600 always won, so every Suricata alert stopped at generic 86601. Each custom rule now chains off the built-in rule for its event type. The pack validator now rejects the broken chain, which it did not detect before.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #417

ADR Impact

• No ADR required

Changes

• Remove rule 303000. Chain alert refinements 303001–303060 off built-in 86601, DNS 303110 off built-in 86603, and flow 303100 off base 86600. Both pack copies stay byte-identical.
• Replace the substring check in both identical validate_techvault.py copies with a bounded parent-topology check. It rejects malformed XML, DTD and entity declarations, duplicate IDs, any decoded_as, unknown rules, and wrong parents.
• Rebind the XML, validator, and lineage checksums. Rebind the SDL exact_artifact digest, the bindings, and the set digests in both packs.
• Add the rule-chain repair to both docs/lineage.md files and the Suricata content design note.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Full completion suite required in CI before merge
• No coverage regression

Targeted: tests.test_techvault_pack and tests.test_techvault_study_pack (68 tests) pass. raes-pack-validate --repo ., raes-pack-validate --packs-root packs, and raes-pack-release check --packs-root packs pass. Before the validator change, 8 new mutation cases failed. Native proof with wazuh-logtest in wazuh/wazuh-manager:4.12.0: a SID 1000010 web-application-attack EVE alert selects 86601 level 3 with the pre-fix file and 303020 level 10 with the fixed file. Flow selects 303100, and DNS selects 303110.

Ground Control Checks

• Repository policy checks required in CI before merge
• Pre-push Codex review completed; all findings fixed or dispositioned

Traceability

• IMPLEMENTS: packs/techvault/assets/content/suricata_rules.xml, packs/techvault-participant-study/assets/content/suricata_rules.xml, packs/techvault/validation/validate_techvault.py, packs/techvault-participant-study/validation/validate_techvault.py
• TESTS: tests/test_techvault_pack.py::test_suricata_content_contract_rejects_broken_variants

Checklist

• Code follows the project's coding standards
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.