New detection rule: destructive-delete-burst

[blitzcrieg1]

Multiple deletions in one session (mass file removal, rm -rf, dropping tables) is a distinct impact pattern worth its own alert.

Task

Add rule_destructive_delete_burst(events) to rules.py + REGISTRY. Fire when >= 3 events in a session have technique_id == "T1485" (Data Destruction). One Detection, severity high, with all delete event_ids.

Acceptance criteria

• Fires on 3 T1485 events; silent on 2.
• Fires + near-miss tests in test_detection_engine.py.
• ruff + pytest green.