…ment tactic collision

Validation flagged: (1) Enterprise has 14 tactics canonically; spec was
missing ResourceDevelopment. (2) MITRE convention does not prefix
tactic names with "ICS:" — Caldera/Atomic Red Team/Navigator all use
unprefixed names. (3) Enterprise and ICS share several tactic names
(Discovery, Command and Control, etc.) with different TA-IDs; unified
variants are a documented v1 limitation, splittable later if needed.

All existing tests/*.rs files use _tests.rs suffix; tests/mitre_coverage.rs
broke the pattern. Merging the regression test into tests/mitre_tests.rs
as a #[test] fn keeps naming consistent and reduces file count.

9 tasks, TDD-per-task, small commits. Task 9 is the full CI-equivalent
check (cargo fmt + clippy + test) — encodes the lesson from PR #61
where skipping fmt-check locally caused a CI Format regression on
initial push.

…s or Information)

…behavior change)

Implements the grouped FINDINGS rendering path in TerminalReporter:
buckets findings by tactic, sorts within each group by verdict then
confidence then original index, emits sections in ATT&CK kill-chain
order, appends Uncategorized last, and expands per-finding MITRE lines
to include the technique name (or '(unknown)' for unrecognised IDs).

…rom tests

…im docs

Local multi-agent review (code, tests, comments, silent failures, type design)
converged on 12 actionable items in 3 buckets — substantive design,
test hygiene, and doc rot. Substantive items validated against
Perplexity before fixing.

Substantive (Perplexity-validated):
- src/mitre.rs: consolidate technique_name + technique_tactic into a
  single source of truth via technique_info(id) -> Option<(name, tactic)>;
  the existing public fns become thin projections. Eliminates the
  parallel-match drift class — adding an ID to one without the other
  is now structurally impossible.
- src/reporter/terminal.rs: extract render_finding_prefix shared by
  flat and grouped per-finding render paths. Common escape/colorize/
  evidence emission lives in one place; each MITRE-line variant owns
  only its trailing two lines.
- tests/mitre_tests.rs: HashSet<MitreTactic> uniqueness check instead
  of format!("{:?}") roundtrip — robust against any future Debug impl
  change.

Test hygiene:
- tests/reporter_tests.rs: anchor tactic-header substring assertions
  on "## " prefix so future analyzer summaries containing the word
  "Discovery" or "Impact" cannot confuse the ordering checks.
- tests/reporter_tests.rs: add test for sort tiebreaker (4 findings
  with identical verdict+confidence must preserve emission order).
- tests/reporter_tests.rs: add test for typo'd-variant separation
  (T1046 known + T1046.999 unknown must end up in distinct buckets).

Doc rot:
- src/mitre.rs: drop "MITRE ATT&CK v18, 14 tactics" version pin;
  drop self-reference "Used by the terminal reporter" from
  all_tactics_in_report_order; drop orphan debug_assert! suggestion
  in technique_name doc (no caller does this and the design dropped
  it during Task 8 review); inline the ICS/Enterprise tactic-name
  collision rationale instead of "see spec / v1 limitation".
- src/reporter/terminal.rs: doc comments on render_finding_prefix,
  render_finding_flat, render_finding_grouped, render_findings_grouped.
- src/analyzer/tls.rs: shared block comment above the SNI match
  explaining why malformed-SNI maps to T1027 (Obfuscated Files or
  Information) rather than T1036 (Masquerading) or T1071.001
  (Web Protocols).

…review