[Examples] Add end-to-end local demo script (fixes #75)

[Ayush7614]

Summary

• Add examples/demo/run-local-demo.sh and run-local-demo.ps1 to verify prerequisites, fire the bundled whoami trigger, poll for a new ECS alert, and print pretty JSON on success.
• Add examples/demo/README.md with usage, expected output, SIEM next-step hints, and macOS experimental notes.
• Link the demo helper from docs/getting-started.md.

Test plan

• Start Rustinel on Linux (sudo ./rustinel run), run ./examples/demo/run-local-demo.sh, confirm exit 0 and alert JSON printed.
• Run with agent stopped — confirm clear error pointing to sudo ./rustinel run.
• Run ./examples/demo/run-local-demo.sh --siem elastic — confirm next-step commands print.
• On Windows, run .\examples\demo\run-local-demo.ps1 with agent running and confirm alert output.
• Run with --trigger-only / -TriggerOnly when agent checks should be skipped.

[Ayush7614]

cc: @Karib0u

[Karib0u]

Thanks for the PR. I am going to request changes for now.

The direction matches #75, but the implementation is not ready to merge:

• The branch currently conflicts with main.
• The Linux/macOS helper uses GNU-specific date behavior, so the macOS path is likely broken.
• Both helpers hardcode logs/alerts.json* instead of respecting alerts.directory and alerts.filename from config.toml.
• The shell helper iterates glob output through command substitution, which breaks paths containing spaces.
• This adds a large amount of script logic without automated checks or tests.

Please rebase on main, make the helpers config-aware and portable, add at least basic automated validation for argument parsing/path handling, and keep the docs/scripts consistent with the repo style.

[Ayush7614]

Thanks for the review @Karib0u — addressed all requested changes in the latest push:

• Rebased on main and resolved the docs/getting-started.md conflict (demo helper links now sit under the updated “Verify The Demo Rule” section for Windows/Linux/macOS).
• Config-aware alert paths — both helpers read [alerts].directory and [alerts].filename from config.toml (defaults: logs / alerts.json) and watch today's {directory}/{filename}.{YYYY-MM-DD} file.
• Portable timing — removed GNU date +%s%N; now_ms() uses python3 or second-granularity fallback (macOS-safe).
• Safe glob iteration — replaced for file in $(...) with nullglob array expansion in lib.sh.
• Automated validation — added examples/demo/validate.sh plus a demo-validate CI job for config parsing and CLI checks.

Happy to adjust anything else during review.