feat: field observability for engine daemon and engine eval (--observe-fields)

[mostafa]

Summary

Adds an opt-in field-observability surface that surfaces two halves of detection coverage:

• Gap signal: event fields no loaded rule references.
• Broken-coverage signal: rule fields that have never appeared in an event.

RSigma owns both rule parsing and event ingestion, so this join is uniquely cheap to deliver. The same surface is now available on both runtimes:

• rsigma engine daemon — live, exposed over HTTP. Off by default; zero overhead unless an operator passes --observe-fields.
• rsigma engine eval — one-shot, emitted as a JSON report at end-of-run. Off by default; same JSON shape as the daemon endpoint so a single jq query works against either runtime (ideal for CI gap analysis).

Engine daemon: new flags

Flag	Default	Purpose
--observe-fields	off	Enable the observer.
--observe-fields-max-keys <N>	10000	Hard ceiling on tracked field names. Overflow drops are counted.

Engine daemon: new HTTP endpoints

Method	Path	Description
GET	/api/v1/fields	One-shot summary + unknown + missing.
GET	/api/v1/fields/unknown	Event fields no rule references.
GET	/api/v1/fields/missing	Rule fields never observed in events.
DELETE	/api/v1/fields/observer	Reset counters.

Each list endpoint supports ?limit=&offset= with total and next_offset. All four return 503 with a hint when the daemon was started without --observe-fields.

Engine daemon: new Prometheus metrics

• rsigma_fields_observed_total (counter)
• rsigma_fields_observer_unique_keys (gauge)
• rsigma_fields_observer_overflow_dropped_total (counter)

Refreshed on every /metrics scrape and after every successful /api/v1/fields/* call. Bridged from the observer's lifetime counters (not the resettable ones) so DELETE /api/v1/fields/observer cannot desync the monotonic counters.

Engine eval: new flags

Flag	Default	Purpose
--observe-fields	off	Enable observation and emit a JSON report at end-of-run.
--observe-fields-max-keys <N>	10000	NonZeroUsize; clap rejects 0 at parse time.
--observe-fields-report <PATH>	unset (stderr)	Where to write the report. requires = observe-fields so the typo case fails fast. Defaults to stderr when omitted so detections on stdout stay machine-consumable.

Example:

# CI: NDJSON detections to stdout, logs to stderr, report in its own file
rsigma engine eval -r rules/ -e @events.ndjson \
    --observe-fields \
    --observe-fields-report coverage.json

jq '.summary | {events_observed, unknown_count, missing_count}' coverage.json

Architecture

To keep engine eval decoupled from the daemon Cargo feature, FieldObserver and the rule-field extraction primitives live in rsigma-eval (the dependency-light core crate that every consumer already links):

• rsigma_eval::field_observer::{FieldObserver, FieldObservation, FieldObservationEntry, FieldCoverage} — the observer and its snapshot type.
• rsigma_eval::fields::{RuleFieldSet, FieldOrigin, FieldSource} — extracted from the CLI's rsigma rule fields so the offline view matches what the engine references at runtime.
• FieldObservation::coverage(&RuleFieldSet) -> FieldCoverage — the gap/intersection/missing join. Both runtimes consume this so the partition semantics cannot drift.

rsigma-eval stays dependency-light: the observer's Mutex<HashMap<Arc<str>, u64>> uses std::sync::Mutex rather than adding parking_lot. Lock-poisoning is treated as a programmer bug because the locked region only does HashMap operations and saturating arithmetic, neither of which can panic.

rsigma-runtime keeps pub use rsigma_eval::{FieldObserver, …} re-exports so existing imports compile unchanged.

Test plan

• cargo fmt --all -- --check clean
• cargo clippy --workspace --all-targets --all-features -- -D warnings clean
• cargo test --workspace --all-features 1491/1491 across 45 suites
• mkdocs build --strict clean
• cli_daemon_fields_observer.rs covers 8 daemon scenarios: 503 when disabled, gap signal, broken-coverage signal, full snapshot, DELETE reset, cap overflow, pagination, /metrics surface
• cli_eval adds 8 eval scenarios: full report shape, unknown surfaced, missing surfaced, --observe-fields-max-keys overflow accounting, stderr default when no path, off-by-default silence, clap requires rejection, NonZeroUsize rejection
• FieldObserver unit tests cover cap enforcement, lifetime-vs-resettable counters, deterministic ordering, plain-event no-op
• FieldObservation::coverage unit tests cover partition correctness, empty-observer-only-missing, and snapshot ordering preservation
• Existing 16 cli_fields tests still pass after the FieldCollector move