feat(ttp): E.3.9 BehavioralLifter (R0031-R0040)

Reads pre-shaped session aggregates from TaggerEvent.payload and emits
techniques per Appendix A behavior tables. Per-rule predicates dispatch
on match.kind (lifter:behavioral_<name>); the lifter holds its own
RuleIndex watching the same RuleStore as the engine, so disable / clip /
TTL state reaches lifter-bound rules through the same atomic-swap path.

R0032/R0036/R0037/R0040 YAMLs had over-escaped regex strings (\\
instead of \\) — fixed in place.

Factory wired so default get_tagger() returns CompositeTagger with
BehavioralLifter shipped; remaining three lifters (E.3.10-E.3.12) land
in subsequent commits.

E.2.6 contract preserved via TolerantTagger: empty payload steady-state
yields [] with zero ERROR records. Disabled / clipped / expired state
verified.

tests/ttp/test_factory.py

@@ -28,12 +28,16 @@ def _ev(source_kind: str) -> TaggerEvent:
     )
 
 
-def test_default_returns_composite_with_empty_lifters(monkeypatch):
+def test_default_returns_composite_with_shipped_lifters(monkeypatch):
+    """E.3.9 onward: the default composite is wired with each shipped
+    lifter. Empty-lifters was the contract-phase shape; once a lifter
+    impl lands the composite carries it.
+    """
     monkeypatch.delenv("DECNET_TTP_TAGGER_TYPE", raising=False)
     t = get_tagger()
     assert isinstance(t, CompositeTagger)
     assert t.name == "composite"
-    assert t._lifters == []
+    assert len(t._lifters) >= 1
 
 
 def test_explicit_composite(monkeypatch):