Generate event rule documentation

CLAUDE.md

@@ -57,6 +57,9 @@ Implemented investigation/response state:
   `response-audit.log`. Dashboard/API plan previews do not write artifacts.
 - `rules list/show/test` exposes built-in and configured event rules and lets
   operators test exec/syscall event JSON fixtures against the rule engines.
+- `rules docs` emits generated Markdown rule docs; `docs/RULES.md` is the
+  checked-in built-in rule reference with match fields, false positives, and
+  drill guidance.
 - IPS behavior is currently explicit workflow: posture hardening plus reviewed
   dry-run containment actions. There is no automatic inline blocking or silent
   host mutation yet.
@@ -65,7 +68,8 @@ Near-term open work:
 
 - Audited `--apply` response execution with tests and rollback notes.
 - Baseline reconciliation for legitimate FIM/package/listener/SUID drift.
-- Generated rule documentation from source defaults and red-team drill mapping.
+- Fixture or red-team drill coverage for every built-in SID, including
+  event-only and future correlation SIDs.
 - More event sources and correlation across exec, network, persistence, FIM,
   and rootcheck signals.
 - Stable schema compatibility tests for alerts, incidents, status, response