v1.3.0: corpus 73 to 80, OpenSearch backend, pipeline support

v1.3.0: corpus 73 to 80, OpenSearch backend, pipeline support

Seven new rule templates, a fifth conversion backend, a validator that catches
templates nobody filled in, and an upper bound on every dependency. The plugin
version has read 1.3.0 since this work started; this tag makes the published
release match it.

Added

• Seven rule templates, taking the corpus from 73 to 80 across MITRE
  ATT&CK:
  • T1114.001 local email collection (OST/PST access)
  • T1110.003 password spraying by distinct-account count
  • T1486+T1490 ransomware chain, temporal correlation
  • T1021.006 remote services over WinRM
  • T1053.005 scheduled task created from a scripting host
  • T1098.003 AWS IAM wildcard-admin policy created
  • T1548.002 UAC bypass via an auto-elevating binary
• OpenSearch as a conversion target. pysigma-backend-opensearch joins
  Splunk, Elastic, Kibana and Wazuh. Lucene and PPL are separate targets, and
  a test asserts they do not quietly resolve to the same one.
• Sysmon and Windows pipelines. convert_rule takes a pipeline name or a
  list of them. An unknown pipeline is an error rather than a silent fallback,
  and a missing pipeline package returns an envelope naming the package to
  install instead of a bare traceback.
• The validator now catches an unfilled template. A rule still carrying a
  REPLACE_ME marker, or a placeholder entry in falsepositives, is a rule
  that looks complete and detects nothing. validate_rule reports both.

Changed

• Every dependency has an upper bound now. mcp was unpinned when
  mcp 2.0.0 shipped on 2026-07-28 and moved mcp.server.fastmcp. The next
  scheduled CI run on main would have failed on its own, with or without
  this release. It is pinned to <2; pysigma and the backends are bounded
  the same way.
• The three skills were updated for the new targets and the pipeline options.

Verification

• pytest -q on Python 3.12: 332 passed, 7 skipped (302 at v1.2.1)
• readme_stamp.py --check in sync: sigma_rule_count=80,
  test_module_count=11
• CodeQL (actions and python) clean, and the OPSEC identifier scan clean

Note

Two things were held back on purpose. The coverage-matrix MCP resource is
written and tested, but its module would ship without the server.py
registration that exposes it, so no client could reach the resource; it waits
for that wiring rather than landing as something the release notes could claim
and users could not use. A mirror-integrity test was also excluded: it asserts
a layout constraint that is false in this repository, where server.py
genuinely exists.