docs(rules-engine-2): document exploit-evidence, reachability and asset-exposure condition fields

[devGregA]

Description

Documents new condition fields in the Rules Engine 2.0 rule-building guide. Pairs with a Pro change that adds these to the rule item envelope; this is the user-facing half.

The available-fields contract table gains two groups:

• Exploit evidence — exploit_maturity, kev_due_date, vex_state
• Reachability — reachability, reachability_confidence

The asset block gains internet_accessible, business_criticality and exposure alongside id and name.

A new section explains what each one means, because several are not self-describing:

• exploit_maturity is a number (0 none, 10 proof of concept, 20 weaponized, 30 observed exploited in the wild), so gte 20 means "weaponized or worse". Documented as a scale because "20" tells a rule author nothing on its own.
• The distinction between reachability (can the vulnerable code be reached inside the application) and exposure (can the asset be reached from outside). These are separate enums on separate rollups and easy to conflate, so the guide names the difference explicitly rather than leaving a reader to infer it.
• Why both exposure answers are offered: the checkbox is what somebody ticked, the verdict is computed from collected evidence, and they can disagree. A rule meaning "reachable from the internet" usually wants the verdict, falling back to the checkbox on an instance with no exposure evidence.

It also records that these fields read empty where the feature populating them is off (reachability reads unknown), so an author knows a rule written against them matches nothing rather than misbehaving.

English only. The translated variants of this page lag behind by design and are updated in dedicated translation passes — the risk-acceptance condition fields added earlier are likewise not yet in them.

Documentation only; no code or behavior change in this repository.