feat(ttp): load MITRE ATT&CK from official STIX 2.1 bundle

Replace the hand-maintained TECHNIQUE_NAMES dict (pinned to v15.1) with
a runtime loader that reads the official enterprise-attack-N.json STIX
bundle. Version bumps now require only updating attack_version.py;
sub-technique parents, tactic IDs, and kill-chain phases all come from
MITRE's published data.

- decnet/ttp/attack_version.py pins version 19.0 + sha256 + URL
- decnet/ttp/attack_stix.py is the lazy STIX loader. Resolution order:
  DECNET_ATTACK_BUNDLE env -> ~/.cache/decnet/attack/ -> fetch from
  the pinned MITRE GitHub URL. SHA-256 verified before parse;
  mismatch fails closed.
- decnet/ttp/attack_catalog.py collapses to a shim re-exporting
  technique_name() so the ~9 router/repo call sites don't churn.
- python -m decnet.ttp.attack_stix fetch warms the cache and can
  print sha256 for version-bump workflows.
- test_attack_catalog.py now asserts every rule-emitted ID resolves
  in the loaded bundle (same contract, real source) and exercises
  the SHA-256-mismatch fail-closed path.

decnet/ttp/attack_version.py

@@ -0,0 +1,36 @@
+"""Pinned MITRE ATT&CK Enterprise STIX bundle version.
+
+Bumping ``ATTACK_BUNDLE_VERSION`` is the *only* code change required
+to track a new ATT&CK release — all technique/tactic names and
+sub-technique parents are loaded from the bundle at runtime via
+``decnet.ttp.attack_stix``. The hash is verified after fetch; a
+mismatch refuses to load (fail-closed, mirroring the bundle-include
+discipline used elsewhere in DECNET).
+
+To regenerate the hash after a version bump::
+
+    .311/bin/python -m decnet.ttp.attack_stix fetch --print-sha
+"""
+from __future__ import annotations
+
+from typing import Final
+
+ATTACK_BUNDLE_VERSION: Final[str] = "19.0"
+
+# sha256 of the canonical MITRE-published enterprise-attack-19.0.json
+# from https://github.com/mitre-attack/attack-stix-data.
+ATTACK_BUNDLE_SHA256: Final[str] = (
+    "df520ea0775a57db7bff760145b02fed89290802913e056b7ed5970b02f3626a"
+)
+
+# Raw download URL for the pinned version.
+ATTACK_BUNDLE_URL: Final[str] = (
+    "https://raw.githubusercontent.com/mitre-attack/attack-stix-data"
+    f"/master/enterprise-attack/enterprise-attack-{ATTACK_BUNDLE_VERSION}.json"
+)
+
+__all__ = [
+    "ATTACK_BUNDLE_SHA256",
+    "ATTACK_BUNDLE_URL",
+    "ATTACK_BUNDLE_VERSION",
+]