[JJediny]

Description

This PR introduces an automated innocent security alert trigger runner, packages the commands into an agent skill, adds comprehensive documentation on developing real-time IoC alerts, and wires desktop notification replay.

Changes

1. Automated Innocent Trigger Runner (tools/trigger_alerts.py):
   • Executes safe, benign trigger commands across Falco (eBPF), OSquery (FIM/results), ClamAV (EICAR), AI Agent Observability (OTLP), RSigma (streaming Sigma), and SystemLogs.
   • Automatically bridges alerts to native Linux desktop notifications (notify-send) via tools/desktop_notifier.py.
   • Supports verification mode (--verify) and stream filtering (--stream <name>).
2. Taskfile Integration (Taskfile.yml):
   • Added task trigger-alerts to safely exercise all pipelines.
3. Agent Skill (.agents/skills/security-alert-triggers/SKILL.md & CLI skill):
   • Reference matrix mapping MITRE techniques to innocent commands, expected log schemas, and verification SQL.
   • Playbook for native Linux desktop notifications via host notifier.
4. Realtime IoC Documentation (docs/developing_realtime_ioc_alerts.md):
   • Architecture diagrams and detection engine comparison matrix.
   • Step-by-step authoring guides for Falco eBPF rules, Sigma YAML rules, OSquery queries, and OpenObserve SQL alerts.
   • The Innocent Trigger Principle and testing lifecycle.

Verification

• Ran python3 tools/trigger_alerts.py --all -> Verified live ingestion across all streams and visual notify-send popups.
• Full pytest test suite: 363 passed, 40 skipped, 0 failed.