docs(rules-engine-2): document the missing-scan trigger

[devGregA]

Description

Documents two additions to Rules Engine 2.0. Pairs with a Pro change; this is the user-facing half.

The missing-scan trigger

A new trigger that reports Assets whose expected scan has not arrived.

Every other trigger answers "which Findings should I act on". This one cannot be asked that way — a scan that never arrived produces no Finding — so it is also the only trigger that takes no scope, and the only one whose items carry no Finding. Both of those needed saying explicitly rather than left for a reader to discover.

Two things a rule author has to know and cannot infer from the settings:

• Naming the expected scan types matters. Left empty, the node checks only types an Asset has already imported, which catches a scanner that stopped but not one that was never wired up — there is nothing to infer the second from. The explicit list catches both.
• The item shape. These items have no Finding, so finding.* paths read empty, but the Asset and expected scan type are carried in their usual product and test places, which is what lets a message template written for Findings keep working. The absence specifics are documented as ctx paths.

It also notes that wiring these into a Findings node is harmless but pointless — there is no Finding to change — so an author who tries it gets an explanation rather than a puzzle.

Corrects the Triggers preamble while there: it said "all three" produce Finding items and take a scope. There are four now, and the new one is the exception on both counts.

Starting a rule from a template

The rules list now offers two ways to begin, and the page only described the empty canvas.

The new section leads with what the gallery shows before anything is adopted, because that is the point of it: what the rule is for, which nodes it contains, and what needs configuring before it works. A reader who skips the setup steps ends up with a scheduled rule that never runs.

It states twice-over that an adopted rule arrives disabled and in simulate mode, and why: several templates raise tickets and send messages, so the first run across an unfiltered set of Assets is not something to discover afterwards. The safety comes from the defaults, but a reader who does not know that will either distrust the feature or be surprised by it.

It also answers the two questions a template gallery invites and does not obviously answer on its own: editing an adopted rule does not affect the template, and adopting the same one twice is supported and yields independent rules — which is how one watchdog covers two different sets of Assets.

Documentation only; no code or behaviour change in this repository.