Persist rule provenance and immutable snapshots for retro-hunts

[haasonsaas]

Context

Retro-hunting applies new YARA-X rules, hashes, and intelligence to retained bytes. A finding is not reproducible unless the rule source, version, content digest, compiler/runtime version, and evaluation time are retained with the result.

Proposal

Add an immutable rule snapshot/provenance record and attach it to hunt jobs, findings, and exports. Support source URI, author/owner, content SHA-256, rule language/runtime version, and configuration digest.

Acceptance criteria

• Two rules with the same name but different content remain distinguishable.
• A finding can be reproduced from its stored rule snapshot or an explicit unavailable state.
• Rule provenance is tenant-scoped and does not store secret credentials.
• Changing a rule creates a new snapshot rather than mutating historical findings.

References

• rules module
• hunt queue
• detection findings