v0.5.0 Phase 4 Broaden (KQL dialect)

Phase 4 Broaden (partial) — optional KQL field extraction

Sigma remains the default. This release adds a pluggable, offline KQL dialect for simple field references — not a query engine or matcher.

What's new

• --dialect sigma|kql|auto on detdrift diff (default sigma) and detdrift fields (default auto by extension)
• Simple KQL extraction: where Field op, project, summarize … by, sort by
• Sample: examples/kql/rules + fixtures/kql
• Docs: README, ROADMAP, ARCHITECTURE updated (Phase 4 started)

Not in this release

• SPL dialect
• PyPI publish (needs secrets)

Verify

pip install -e .[dev]
pytest -q
detdrift fields examples/kql/rules/whoami_process.kql
detdrift diff -b fixtures/kql/before -a fixtures/kql/after -r examples/kql/rules --dialect kql