feat(ttp): E.3.8 R0031-R0040 behavioral cohort

10 YAMLs for the behavioral / cross-event cohort per Appendix B:
beaconing, data destruction, ransom note, web exfil, DB mass-read,
credentials-in-files, k8s SA token harvest, Docker host escape,
LLMNR poisoning, TFTP router-config retrieval.

Every rule is lifter-bound (BehavioralLifter / IdentityLifter) —
the v0 RuleEngine cannot count, aggregate, or compose cross-event
signals, so these YAMLs declare the technique mappings the lifter
will consume by rule_id at E.3.9. Their match specs use a
'kind: lifter:*' shape inert to the regex matcher.

test_behavioral_rules.py asserts each YAML compiles, none fire
from the v0 engine (FP regression guard against a YAML drifting
into a regex), and an xfail(strict=True, reason='impl phase E.3.9')
precision case that will flip green when the lifter lands.

rules/ttp/R0036.yaml

@@ -0,0 +1,25 @@
+rule_id: R0036
+rule_version: 1
+name: credentials_in_files
+description: |
+  Reading .env / .git/config / cloud credential files —
+  credential-from-file harvesting. Lifter-driven so the rule
+  composes the file-access signal with the path discriminator.
+applies_to:
+  - session
+  - http_request
+match:
+  kind: lifter:credentials_in_files
+  paths:
+    - '\\.env'
+    - '\\.git/config'
+    - '\\.aws/credentials'
+    - '\\.ssh/id_rsa'
+    - 'wp-config\\.php'
+emits:
+  - tactic: TA0006
+    technique_id: T1552
+    sub_technique_id: T1552.001
+    confidence: 0.9
+evidence_fields:
+  - matched_path