feat(ttp): E.3.8 R0041-R0048 email cohort

8 YAMLs for the email cohort per Appendix B: open-relay abuse,
mass phishing, phishing-kit X-Mailer signatures, IDN/punycode
URLs, sender masquerade, malicious attachment, BEC, encoded
payload in body. EmailLifter (E.3.12) consumes by rule_id.

test_email_rules.py: YAML-present + inert-in-v0 + xfail(strict)
precision case gated on E.3.12.

rules/ttp/R0047.yaml

@@ -0,0 +1,31 @@
+rule_id: R0047
+rule_version: 1
+name: bec_pattern
+description: |
+  Business email compromise: urgent-wire / CEO-impersonation
+  language + a request-for-action shape (gift cards, wire,
+  payroll change). Subject + body composite signal.
+applies_to:
+  - email
+match:
+  kind: lifter:email_bec
+  subject_keywords:
+    - urgent
+    - wire
+    - invoice
+    - payroll
+    - gift card
+  body_action_keywords:
+    - send
+    - transfer
+    - update banking
+    - confidential
+emits:
+  - tactic: TA0001
+    technique_id: T1566
+    sub_technique_id: T1566.003
+    confidence: 0.85
+evidence_fields:
+  - subject
+  - matched_subject_kw
+  - matched_body_kw