refactor(ttp): normalise lifter:<owner>_<name> match.kind prefix

E.3.9.1 prerequisite. Rules R0031-R0040 now use lifter:behavioral_*,
R0041 (open_relay) uses lifter:email_open_relay; the rest of the email,
canary, and intel cohorts already conformed. Each lifter at E.3.9-E.3.12
will claim its rules via str.startswith('lifter:<owner>_'), keeping the
ownership routing explicit and trivially extensible.

R0001-R0006 / R0030 lifter:* rules are E.3.13 (Identity/Credential)
territory and stay as-is.

rules/ttp/R0036.yaml

@@ -9,7 +9,7 @@ applies_to:
   - session
   - http_request
 match:
-  kind: lifter:credentials_in_files
+  kind: lifter:behavioral_credentials_in_files
   paths:
     - '\\.env'
     - '\\.git/config'