Add enrichment and SID coverage gates

docs/RULES.md

@@ -4,6 +4,11 @@ Generated from the active exec/syscall rule defaults plus any configured `exec_r
 
 Use `enodia-sentinel rules list/show/test` to inspect rules and validate event fixtures locally.
 
+Built-in event-rule fixtures live in `tests/fixtures/sids/` and can be replayed
+with `enodia-sentinel rules test tests/fixtures/sids/<sid>-<slug>.json`.
+Non-event built-in SIDs are covered by safe offline drills in `tests/sid_drills.py`;
+`python3 -m unittest tests.test_sid_coverage -v` verifies the full registry.
+
 ## SID 100001: Program executed from a world-writable directory
 
 - Event: `exec`