feat: add shared detection content specification v1

[egrexsec]

Summary

• add the shared DetLab Detection Content Specification v1 JSON Schema
• normalize canonical Sigma rules into the portable contract
• record canonical source hashes and generated-artifact provenance
• validate every authored Sigma rule through the contract in CI
• document that Sigma remains canonical and generated queries remain derived

Validation

• python playbook validate
• python -m unittest discover -s tests -p 'test_*.py' -v
• python playbook --json sigma lint
• python automation/validators/check_markdown.py
• git diff --check

Boundaries

• no live lab or SIEM validation was performed
• this PR does not replace authored Sigma or claim generated targets are live validated
• contract schema is byte-identical to the copy proposed in egrexsec/DetLab-DAC