Detection decay monitor

A detection rule ships after review, fires during testing, and then runs untouched. Nothing in a normal SIEM reports that it has stopped working. A rule that has gone blind and a rule with nothing to catch both produce zero alerts, and a dashboard renders them the same way.

Four things break a working rule and none of them raise an error: the log source stops forwarding, a field is renamed or emptied while its event keeps arriving, someone edits the rule, or the attacker technique moves outside the selection logic. This system scores decay continuously and then tries to tell those four apart, because the fix is different in each case.