Add detection content validation and linting workflow

[egrexsec]

Objective

Introduce lightweight validation for canonical detection briefs so DetLab-DAC can enforce documentation-first detection quality before content is merged.

Rationale

DetLab-DAC should not feel like loose markdown around queries. A validation workflow would reinforce the core positioning: telemetry assumptions, ATT&CK mapping, triage guidance, and implementation parity are part of the detection artifact.

Scope

• Define required frontmatter fields for canonical detection briefs.
• Validate required markdown sections such as summary, telemetry, ATT&CK, implementations, false positives, triage, and validation notes.
• Add a CI-friendly script or test that runs against detections/examples.
• Document how contributors run validation locally.

Acceptance criteria

• Invalid detection artifacts fail validation with actionable messages.
• Existing examples either pass or have tracked follow-up gaps.
• README or CONTRIBUTING links to the validation workflow.
• The workflow stays documentation-focused and does not require a live SIEM.