feat(ttp): E.3.9 BehavioralLifter (R0031-R0040)

Reads pre-shaped session aggregates from TaggerEvent.payload and emits
techniques per Appendix A behavior tables. Per-rule predicates dispatch
on match.kind (lifter:behavioral_<name>); the lifter holds its own
RuleIndex watching the same RuleStore as the engine, so disable / clip /
TTL state reaches lifter-bound rules through the same atomic-swap path.

R0032/R0036/R0037/R0040 YAMLs had over-escaped regex strings (\\
instead of \\) — fixed in place.

Factory wired so default get_tagger() returns CompositeTagger with
BehavioralLifter shipped; remaining three lifters (E.3.10-E.3.12) land
in subsequent commits.

E.2.6 contract preserved via TolerantTagger: empty payload steady-state
yields [] with zero ERROR records. Disabled / clipped / expired state
verified.

tests/ttp/_stub_store.py

@@ -0,0 +1,48 @@
+"""Shared stub :class:`RuleStore` for lifter unit tests.
+
+Tests that exercise :class:`BehavioralLifter` / :class:`IntelLifter` /
+:class:`CanaryFingerprintLifter` / :class:`EmailLifter` need a store
+reference at construction. Most don't drive the watch loop — they
+inject rules into the lifter's :class:`RuleIndex` directly. This stub
+provides just enough of the ABC to satisfy construction.
+"""
+from __future__ import annotations
+
+from collections.abc import AsyncIterator
+from typing import Any
+
+from decnet.ttp.impl.rule_engine import CompiledRule
+from decnet.ttp.store.base import RuleChange, RuleState, RuleStore
+
+
+class StubRuleStore(RuleStore):
+    """In-memory store with optional preloaded compiled rules."""
+
+    def __init__(
+        self,
+        compiled: list[CompiledRule] | None = None,
+        changes: list[RuleChange] | None = None,
+    ) -> None:
+        self._compiled = list(compiled or [])
+        self._changes = list(changes or [])
+
+    async def load_compiled(self) -> list[CompiledRule]:
+        return list(self._compiled)
+
+    async def get_state(self, _rule_id: str) -> RuleState:
+        return RuleState()
+
+    async def set_state(self, *_a: Any, **_kw: Any) -> None:
+        return None
+
+    def subscribe_changes(self) -> AsyncIterator[RuleChange]:
+        changes = list(self._changes)
+
+        async def _gen() -> AsyncIterator[RuleChange]:
+            for change in changes:
+                yield change
+
+        return _gen()
+
+
+__all__ = ["StubRuleStore"]