Add event rule inspection commands

CLAUDE.md

@@ -55,6 +55,8 @@ Implemented investigation/response state:
 - `respond plan <incident-id>` builds read-only containment/recovery plans,
   persists CLI-generated plans under `response-plans/`, and appends
   `response-audit.log`. Dashboard/API plan previews do not write artifacts.
+- `rules list/show/test` exposes built-in and configured event rules and lets
+  operators test exec/syscall event JSON fixtures against the rule engines.
 - IPS behavior is currently explicit workflow: posture hardening plus reviewed
   dry-run containment actions. There is no automatic inline blocking or silent
   host mutation yet.
@@ -63,7 +65,7 @@ Near-term open work:
 
 - Audited `--apply` response execution with tests and rollback notes.
 - Baseline reconciliation for legitimate FIM/package/listener/SUID drift.
-- Rule inspection/test commands and generated rule documentation.
+- Generated rule documentation from source defaults and red-team drill mapping.
 - More event sources and correlation across exec, network, persistence, FIM,
   and rootcheck signals.
 - Stable schema compatibility tests for alerts, incidents, status, response
@@ -137,6 +139,7 @@ python3 -m enodia_sentinel.cli rootcheck
 python3 -m enodia_sentinel.cli posture check --json
 python3 -m enodia_sentinel.cli incident list
 python3 -m enodia_sentinel.cli respond plan <incident-id> --json
+python3 -m enodia_sentinel.cli rules list
 python3 -m enodia_sentinel.cli web
 ```