[mostafa]

Stacked on #609; merge that first.

Closes #593.

Rule integers became f64 at lowering, so any literal above 2^53 rounded to a neighbor before eval or conversion saw it. pid: 9007199254740993 matched 9007199254740992 and not itself, pid|gt: 9007199254740992 missed 9007199254740993, an integer keyword searched for the rounded digits, and every backend (plus backend reverse from Lucene) emitted the rounded number.

Changes

• rsigma-ir gains NumericLiteral (Integer(i64) or Float(f64)), and IrNumber::Literal holds it. Lowering keeps YAML integers and integer strings as Integer; raising maps them back to SigmaValue::Integer unchanged. HIR_SCHEMA_VERSION goes from 3 to 4 because the serialized shape changed.
• CompiledMatcher::NumericEq/Gt/Gte/Lt/Lte hold a NumericLiteral. An integer literal compares exactly against integer events, against strings that parse as i64, and against floats through an exact float-to-integer ordering (so 9007199254740992.0 equals ...992 and is less than ...993). Float literals keep the existing f64 behavior. Integer keywords search for the exact digits.
• The Backend numeric leaves (convert_field_eq_num, convert_field_compare_op, convert_keyword_num) take a NumericLiteral. Its Display replaces the four per-backend whole-number formatters, so PostgreSQL, LynxDB, Fibratus, and the test backend all render the exact digits. This is a breaking change for custom backends; the fix is value.to_string().

Testing

• modifier_conformance: equality, gt/gte/lt/lte, and keywords at 2^53 + 1 against integer, string, and float events. All three tests fail on main.
• New large_integers golden cases for PostgreSQL, LynxDB, Fibratus, and the Lucene reverse frontend. All four fail on main with 9007199254740992.
• Unit tests for the float-to-integer ordering (NaN, infinities, i64::MIN/i64::MAX, negative fractions) and for NumericLiteral parsing and display.
• SigmaHQ corpus regression (rules, rules-threat-hunting, rules-emerging-threats, rules-compliance, rules-dfir, rules-placeholder): identical to main, 3748 compiled and 0 errors.
• cargo fmt, clippy -D warnings, cargo doc, the full workspace test suite, and docs:build/docs:validate pass locally. CI does not run on this PR because its base is not main.