docs(rules): add false-positive taxonomy

[stacknil]

Summary

• add a standalone false-positive taxonomy for brute-force, multi-user probing, and sudo burst findings
• distinguish NAT, bastion, internal scanner, lab replay, scheduled admin task, and shared-account contexts
• document corroborating evidence, residual uncertainty, cross-rule interpretation, and evidence-integrity boundaries
• link the taxonomy from the rule catalog, case study, reviewer path, README, and changelog

Validation

• cmake -S . -B build
• cmake --build build
• ctest --test-dir build -C Debug --output-on-failure
• git diff --check
• custom taxonomy coverage check: 3 rules x 6 sources and 3 verdict boundaries
• local Markdown link check: 53 links
• privacy/secret marker scan of changed docs