docs(connectors): document selecting Checkmarx One scans by Initiator

docs/content/connectors/toolreference/checkmarx_one.md

@@ -36,6 +36,22 @@ Notes on **Track Scanned Branches**:
 - Turning the toggle off later is safe: per-branch engagements simply stop receiving imports and the default engagement resumes on the next sync.
 - Connectors reconcile state on the sync schedule. Branch tracking makes each sync complete across branches; it does not make data real-time between syncs.
 
+#### **Selecting scans by Initiator**
+
+Some scans can only be told apart by who started them, for example scans run by a QA service account on branches your **Branch** filter does not select. The optional **Initiator** field selects those scans by the Checkmarx scan's Initiator (the user or service that started it).
+
+- **Initiator** is a regular expression, matched anywhere in the Initiator unless you anchor it with `^` and `$`. For example `^qa-scanner-\d{2}$` matches `qa-scanner-01`, and `Sécurité` matches any Initiator containing that word.
+- Matching **ignores case and accents** on both sides, so `Sécurité` also matches `SECURITE` and `securite`.
+- The pattern uses [RE2 syntax](https://github.com/google/re2/wiki/Syntax). An invalid pattern is rejected when you save the connector.
+
+How it combines with the branch fields:
+
+- A scan is selected when its branch matches **Branch** **or** its Initiator matches **Initiator**. For a branch the Branch field selects, the connector imports that branch's latest completed scan, as it does without an Initiator. For any other branch, it imports the latest completed scan whose Initiator matches. A wildcard Branch that matches nothing no longer skips the sync, because the Initiator-matched branches still import.
+- Setting **Initiator** always syncs per branch, as if **Track Scanned Branches** were on: each selected branch gets its own engagement, so Initiator-matched scans and Branch-matched scans never share an engagement or close each other's findings.
+- With **Branch** blank, only Initiator-matched scans are imported. You can use this for a separate connector that covers only those scans, alongside your existing connector.
+- Only the most recent 1,000 completed scans of each project are searched for a matching Initiator. A branch whose last matching scan is older than that stops receiving updates, the same way a branch that stops being scanned does.
+- Clearing **Initiator** later does not close anything: the engagements of branches it alone selected stop receiving imports and keep their last-known findings, which you can review and close in bulk. If **Track Scanned Branches** is off, the default engagement resumes on the next sync, as when that toggle is turned off.
+
 #### **Result States**
 
 By default, the connector imports findings in every Checkmarx result state except **Not Exploitable**. To import only findings in some states, fill in the optional **Result States** field.