feat(ttp): E.3.9 BehavioralLifter (R0031-R0040)

Reads pre-shaped session aggregates from TaggerEvent.payload and emits
techniques per Appendix A behavior tables. Per-rule predicates dispatch
on match.kind (lifter:behavioral_<name>); the lifter holds its own
RuleIndex watching the same RuleStore as the engine, so disable / clip /
TTL state reaches lifter-bound rules through the same atomic-swap path.

R0032/R0036/R0037/R0040 YAMLs had over-escaped regex strings (\\
instead of \\) — fixed in place.

Factory wired so default get_tagger() returns CompositeTagger with
BehavioralLifter shipped; remaining three lifters (E.3.10-E.3.12) land
in subsequent commits.

E.2.6 contract preserved via TolerantTagger: empty payload steady-state
yields [] with zero ERROR records. Disabled / clipped / expired state
verified.

rules/ttp/R0032.yaml

@@ -11,10 +11,10 @@ match:
   kind: lifter:behavioral_data_destruction
   patterns:
     - 'FLUSHALL'
-    - 'DROP\\s+DATABASE'
-    - 'TRUNCATE\\s+TABLE'
-    - 'dropDatabase\\(\\)'
-    - 'DELETE\\s+/\\_all'
+    - 'DROP\s+DATABASE'
+    - 'TRUNCATE\s+TABLE'
+    - 'dropDatabase\(\)'
+    - 'DELETE\s+/\_all'
 emits:
   - tactic: TA0040
     technique_id: T1485

rules/ttp/R0036.yaml

@@ -11,11 +11,11 @@ applies_to:
 match:
   kind: lifter:behavioral_credentials_in_files
   paths:
-    - '\\.env'
-    - '\\.git/config'
-    - '\\.aws/credentials'
-    - '\\.ssh/id_rsa'
-    - 'wp-config\\.php'
+    - '\.env'
+    - '\.git/config'
+    - '\.aws/credentials'
+    - '\.ssh/id_rsa'
+    - 'wp-config\.php'
 emits:
   - tactic: TA0006
     technique_id: T1552

rules/ttp/R0037.yaml

@@ -11,7 +11,7 @@ match:
   kind: lifter:behavioral_k8s_sa_token
   paths:
     - '/api/v1/namespaces/[^/]+/secrets'
-    - '/var/run/secrets/kubernetes\\.io/serviceaccount'
+    - '/var/run/secrets/kubernetes\.io/serviceaccount'
 emits:
   - tactic: TA0006
     technique_id: T1552

rules/ttp/R0040.yaml

@@ -10,7 +10,7 @@ match:
   kind: lifter:behavioral_tftp_router_config
   filename_patterns:
     - '.*-confg$'
-    - '.*\\.cfg$'
+    - '.*\.cfg$'
     - 'startup-config'
     - 'running-config'
 emits: