Split action_ext on the first dot to match the API

[concentrator]

Summary

A path's final segment was split into action_name / action_ext on the last dot, but the API splits on the first dot. For a multi-dot segment (archive.tar.gz) the provider produced action_ext = gz, disagreeing with the API's tar.gz — which the hits data source catches as an action-hash mismatch and turns into a hard error.

• Fix (both sites, now consistent): actionNameExtConditions (hits path-to-action) and parseLastSegment (action_path expansion) split on the first dot via strings.Cut.
• Guard: validateActionPath rejects a malformed action_path wildcard (a * fused into a value, e.g. report.2024.*) at plan time with a clear error, instead of silently building a non-matching rule.
• Docs: action.md, rules-core.md, hits-to-rules.md reconciled to the first-dot behavior.
• Reference data: added the /.env dotfile case (empty action_name + action_ext=env), confirmed against the live API; consolidated the action-examples fixture to a single spec/ file (the round-trip test now reads it directly, dropping a duplicate 343-example copy).

Behavior change

An existing multi-dot action_path resource re-decomposes on its next plan (one-time re-plan). This is intended — it aligns the provider with the API's decomposition.

Test plan

• Unit: multi-dot regression tests for both split functions (red→green); validateActionPath valid/invalid table; round-trip test passes on the consolidated fixture.
• make test and make lint green.
• Targeted acceptance tests green against a test client: hits data source (request + attack mode) and disable_stamp CRUD.