docs(debt): merge rogue root DEBT.md into the canonical development/DEBT.md

A previous agent (and several of my own commits) wrote to a top-level
DEBT.md without seeing the existing development/DEBT.md — the
canonical register since DEBT-001. Resulted in two parallel files,
inconsistent numbering schemes, and references that resolved to the
wrong place.

Migrate the six entries that landed in the rogue file into the
canonical register as DEBT-044 through DEBT-049, preserving their
status (resolved / partial / open) and cross-references. The
TTP_TAGGING.md references to "DEBT.md" already resolve to
development/DEBT.md by virtue of being in the same directory; only
the comment in decnet/ttp/impl/intel_lifter.py needed disambiguation
to "development/DEBT.md DEBT-048".

* DEBT-044 — `attacker.email.received` producer wiring (✅ RESOLVED 2026-05-02)
* DEBT-045 — EmailLifter heavyweight feature extraction (PARTIAL PAID 2026-05-02)
* DEBT-046 — EmailLifter mal-hash feed integration (open)
* DEBT-047 — EmailLifter R0047 BEC unblock (open, gated on DEBT-035)
* DEBT-048 — TTP intel provider mapping review (recurring quarterly)
* DEBT-049 — TTP Sigma adapter — post-v1 (open)

Summary table extended; "Remaining open" line updated; root file
removed. The DEBT-047 entry now explicitly cross-references DEBT-035
as the gating dependency for the R0047 BEC unblock.

decnet/ttp/impl/intel_lifter.py

@@ -32,10 +32,11 @@ from decnet.web.db.models.ttp import TTPTag, compute_tag_uuid
 # from TTP_TAGGING.md Appendix A.10 (post 2026-05-02 ship-time audit).
 # Category code names are AbuseIPDB's canonical taxonomy at
 # https://www.abuseipdb.com/categories — kept verbatim in the comment so
-# the next quarterly drift check (per DEBT.md) can diff cheaply. Cat 4
-# (DDoS Attack) and 10 (Web Spam) and 12 (Blog Spam) are intentionally
-# unmapped — design doc §A.10 marks DDoS-without-protocol as too muddy
-# for v0, and CMS spam has no clean ATT&CK fit at the IP layer.
+# the next quarterly drift check (development/DEBT.md DEBT-048) can
+# diff cheaply. Cat 4 (DDoS Attack) and 10 (Web Spam) and 12 (Blog
+# Spam) are intentionally unmapped — design doc §A.10 marks
+# DDoS-without-protocol as too muddy for v0, and CMS spam has no clean
+# ATT&CK fit at the IP layer.
 _ABUSEIPDB_CATEGORY_TO_TECHNIQUES: Final[dict[int, frozenset[str]]] = {
     5: frozenset({"T1110"}),                  # FTP Brute-Force
     7: frozenset({"T1566"}),                  # Phishing