Architecture decision records

• ADR 0001: Evaluate rules with ANVIL's own engine; use pySigma for conversion and as an oracle
• ADR 0002: Route rules by log source and index them by (channel, EventID)
• ADR 0003: Measure against real public datasets, fetched on demand and never committed
• ADR 0004: The drafter proposes, a human approves, and the tests decide
• ADR 0005: A static HTML health dashboard instead of a React app
• ADR 0006: Two decay checks: symbolic schema analysis and TP regression
• ADR 0007: Linux and AWS CloudTrail routing