feat(ttp): E.3.9 BehavioralLifter (R0031-R0040)

Reads pre-shaped session aggregates from TaggerEvent.payload and emits
techniques per Appendix A behavior tables. Per-rule predicates dispatch
on match.kind (lifter:behavioral_<name>); the lifter holds its own
RuleIndex watching the same RuleStore as the engine, so disable / clip /
TTL state reaches lifter-bound rules through the same atomic-swap path.

R0032/R0036/R0037/R0040 YAMLs had over-escaped regex strings (\\
instead of \\) — fixed in place.

Factory wired so default get_tagger() returns CompositeTagger with
BehavioralLifter shipped; remaining three lifters (E.3.10-E.3.12) land
in subsequent commits.

E.2.6 contract preserved via TolerantTagger: empty payload steady-state
yields [] with zero ERROR records. Disabled / clipped / expired state
verified.

tests/ttp/test_lifter_absence.py

@@ -33,6 +33,18 @@ from decnet.ttp.impl.credential_lifter import CredentialLifter
 from decnet.ttp.impl.email_lifter import EmailLifter
 from decnet.ttp.impl.identity_lifter import IdentityLifter
 from decnet.ttp.impl.intel_lifter import IntelLifter
+from tests.ttp._stub_store import StubRuleStore
+
+
+def _make_lifter(cls: type[TolerantTagger]) -> TolerantTagger:
+    """Construct a lifter with whatever its current signature wants.
+
+    Implemented lifters (E.3.9–E.3.12) take a :class:`RuleStore`; the
+    still-empty IdentityLifter / CredentialLifter (E.3.13) take no args.
+    """
+    if cls is BehavioralLifter:
+        return cls(StubRuleStore())  # type: ignore[call-arg]
+    return cls()
 
 
 def _ev(source_kind: str, payload: dict[str, Any] | None = None) -> TaggerEvent:
@@ -77,7 +89,7 @@ def test_lifter_tolerates_absence(
 ) -> None:
     caplog.clear()
     caplog.set_level(logging.DEBUG)
-    lifter = lifter_cls()
+    lifter = _make_lifter(lifter_cls)
     out = asyncio.run(lifter.tag(_ev(source_kind, payload)))
     assert out == []
     # The load-bearing property: no ERROR-or-above records. WARNING