[mostafa]

Stacked on #612; merge that first.

Closes #591.

With MatchDetailLevel above Off, a firing rule was evaluated three times: once to decide the match, once more to collect selection names, and a third walk to collect field matches, re-running every matcher (regexes included) on each pass.

Changes

• The detail pass now records field matches per selection while it evaluates (SelectionDetail { name, fields }), and the attribution rules from fix(eval): report only the selections that decide a match #612 decide which selections' fields survive. The separate field-collection walk is gone.
• ArrayMatch computes member verdicts once and reuses them for both the quantifier and the reported members.
• eval_condition goes through the same pass at level Off.
• rsigma_runtime::EventFilter takes the parsed line by value (dyn Fn(serde_json::Value) -> Vec<serde_json::Value>), and JsonEvent::into_value is new. With no filter or a --jq filter, the daemon and engine eval no longer copy each JSON line; --jsonpath copies only the nodes it matches. This is a breaking change for custom filter implementors.

Verification

• New eval_matched_detail bench (200 rules that all fire): Off 252.47 to 243.90 µs (-3.1%), Full 314.29 to 306.87 µs (-2.9%).
• Match output is identical to the base branch on 205 regression events against SigmaHQ rules/ (793 matches) at off, summary, and full, and with --jq '.records[]' and --jsonpath '$.records[*]' over wrapped batches. The comparison sorts matched_selections, matched_fields, and object keys, because selector member order and custom_attributes key order already vary between runs.
• SigmaHQ corpus validation is identical to main (3748 rules compiled, 0 errors).