Sigma rule validator

It reads one rule per document against the Sigma 2.x specification and its JSON schema: required title, logsource, and detection, the status and level vocabularies, UUID and date shapes, tag formatting, and the condition grammar (1 of, any of, all of them, patterns, not, brackets). Beyond the schema it checks what the schema cannot express: modifier spelling against the v2.1.0 modifier list, value types per modifier, all on a single value, null inside a value list, and unused search identifiers. Aggregations and near comparisons from Sigma 1.x are reported as removed in 2.0 rather than passing silently. It is a hand-rolled check, not the official schema validator binary; unknown top-level keys pass because the spec allows custom fields. Regex flavor checks are advisory only, and ATT&CK naming comes from a vendored snapshot, so fresh techniques may be unnamed.