feat(sources): louder pipeline-embedded sources: deprecation, hide from docs

[mostafa]

Closes #136.

Summary

• Adds a loud stderr warning: line every time a pipeline file declares an inline sources: block. The structured tracing::warn! event stays in place for daemons that already parse it (now enriched with a path field).
• Centralises the emission in a new public rsigma_runtime::warn_pipeline_inline_sources helper, so two paths share one warning text and one process-wide canonical-path dedup set:
  • CLI startup, via rsigma-cli's load_pipelines and pipeline resolve. Every command that loads a pipeline now surfaces the warning consistently (engine eval, engine daemon, rule validate, rule fields, backend convert, pipeline resolve).
  • Daemon hot-reload, via rsigma-runtime's RuntimeEngine::load_rules -> reload_pipelines. A SIGHUP, file-watcher event, or POST /api/v1/reload that re-reads a deprecated pipeline now surfaces the warning even though the reload path does not go back through the CLI's load_pipelines. Library consumers that drive RuntimeEngine themselves inherit the same behaviour.
• The dedup set lives inside the runtime helper, so the daemon's hot-reload loop is a no-op after the first warning per canonical pipeline path. The CLI's load_pipelines shares the same set.
• Rewrites every doc-site and README example for dynamic sources to use the external --source form. The pipeline-embedded form now lives only in a short "Deprecated" callout that points operators at rsigma rule migrate-sources and the v1.0 removal issue (sources: remove deprecated pipeline-level sources: (v1.0) #137).

Deprecation cycle

Stage	Behaviour	Tracked in
Phase 1 (v0.13.0, shipped #135)	tracing::warn! at parse time, recommends --source	#135
Phase 3 (this PR)	adds stderr warning: line, plumbs warning through daemon hot-reload, all doc examples switch to --source	#136
Phase 4 (v1.0)	hard parse error, Pipeline.sources removed	#137

This mirrors the CLI command groups deprecation cycle precedent: each post-deprecation step gets a tracking issue opened at the same time the deprecation lands, so the project has a public, dated commitment for the follow-up work.

Code surface

• crates/rsigma-runtime/src/pipeline_deprecation.rs (new): hosts warn_pipeline_inline_sources, the process-wide canonical-path dedup set (OnceLock<Mutex<HashSet<PathBuf>>>), and two test-only helpers (reset_inline_sources_dedup_for_tests, tests_only_snapshot). Re-exported from rsigma_runtime crate root.
• crates/rsigma-runtime/src/engine.rs: reload_pipelines now calls the helper for every reloaded pipeline that still declares an inline sources: block, so the daemon's hot-reload path covers the deprecation. Three new unit tests (load_rules_surfaces_inline_sources_deprecation_through_runtime, load_rules_does_not_warn_when_pipeline_has_no_inline_sources, hot_reload_dedups_inline_sources_warning_for_same_pipeline_path) drive RuntimeEngine::load_rules directly to pin the contract.
• crates/rsigma-cli/src/main.rs: removes the duplicate CLI-local helper and dedup static; load_pipelines now calls into rsigma_runtime::warn_pipeline_inline_sources directly. The HashSet/Mutex/OnceLock/Path imports it brought along go too.
• crates/rsigma-cli/src/commands/daemon.rs: the inline tracing::warn! loop that ran at daemon startup is removed in favour of the helper. A short comment in its place explains where the warning now lives.
• crates/rsigma-cli/src/commands/resolve.rs: pipeline resolve parses pipeline files directly, so it calls rsigma_runtime::warn_pipeline_inline_sources inline.
• crates/rsigma-cli/tests/cli_sources_deprecation.rs: integration-test suite with six subprocess-spawned tests pinning the stderr emission across rule validate / engine eval / pipeline resolve, the dedup invariant when the same pipeline is passed twice via -p, the negative case, and the migration-command suggestion (the warning embeds the actual pipeline path so the suggested rsigma rule migrate-sources invocation is copy-pasteable).

Docs and READMEs

• docs/reference/dynamic-sources.md: collapses the two declaration sub-sections into a single "Source declaration" section whose body is the external-file shape. The deprecated form is a one-paragraph admonition.
• docs/guide/processing-pipelines.md: same treatment in the dynamic-pipelines walkthrough; the sources file and the pipeline file are shown side by side with a single bash invocation that wires them together.
• docs/guide/enrichers.md: enrich_ip_employee and enrich_cve_kev recipes now declare backing sources in sources.yml loaded via --source. Fixes the bogus mapping-form sources: block that snuck into the original copy.
• docs/cli/engine/daemon.md: clarifies the uniqueness contract on --source and points at the deprecation note.
• README.md (root) and crates/rsigma-cli/README.md: examples and recipe catalog mirror the docs-site form. The CLI README's recipe-catalog refresh values switch from the unsupported { interval: ... } mapping form to the literal-duration syntax (1h, 24h) that the parser actually accepts.
• crates/rsigma-runtime/README.md: DaemonSourceRegistry description marks pipeline-embedded sources as deprecated rather than co-equal.
• CHANGELOG.md: [Unreleased] entry covers the louder warning, the runtime/CLI helper split, the daemon hot-reload coverage, the doc/README sweep, and the new tests.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-features (1502 passed, 46 suites; +5 over pre-rebase baseline for the three new engine tests and two new pipeline_deprecation tests)
• mkdocs build --strict
• cargo test -p rsigma --test cli_sources_deprecation (6 passed; unchanged surface, now exercising the runtime helper through the CLI)
• cargo test -p rsigma-runtime --lib engine::tests (3 passed; hot-reload path pinned)
• cargo test -p rsigma-runtime --lib pipeline_deprecation::tests (2 passed; dedup primitive pinned)

Backward compatibility

Pipeline files that declare an inline sources: block continue to load successfully. The only behaviour change is the extra warning: line on stderr at every first load per canonical pipeline path, and the doc copy no longer documenting the embedded form as a recommended pattern.

[mostafa]

Held for post-v0.13.0 merge. Phases 1+2 of the detached-dynamic-sources cycle are on main but have not shipped yet (still in [Unreleased] as of this PR). Merging this Phase 3 PR before v0.13.0 cuts would collapse Phases 1+2+3 into a single release and skip the "visible-deprecated only" intermediate beat that the cycle is designed to give operators.

Marking as draft until v0.13.0 ships. After that, rebase onto post-v0.13.0 main and merge.

Rebase note for whoever picks this up after v0.13.0: the CHANGELOG commit (4af48b8) anchors its new entry above ### Deprecated CLI aliases hidden from --help (#125). When v0.13.0 cuts the current [Unreleased] section into ## [0.13.0] - <date>, that anchor moves with it. The rebase will silently land the Phase 3 entry under v0.13.0 instead of the new (empty) [Unreleased]. Fix is a small one-line move to relocate the entry into the new [Unreleased] block before merging.

cc: tracks #136.