fix(macos): align native log fields with security rule consumers

[rvald26]

Native macOS logs emit message, process, class_name, level and timestamp. Thirty bounded raw/output records confirmed that 35 shipped rules read log.eventMessage instead of the produced log.message, while host/process/device-time standard mappings were missing. This draft aligns all 36 macOS consumers with the actual fields, promotes verified values into the pinned ThreatWinds SDK schema, and preserves legacy/vendor aliases. No PID standard field is invented and no actionResult is inferred from log level.

Both macOS filters now handle the optional forwarding wrapper without duplicate message capture. Only a valid vendor datasource override replaces ingress identity; empty/unknown/malformed values remain under the vendor field. Multiline messages are preserved and noise drops run once their required fields are extracted. No wrapper events were observed in the bounded search: those cases are source/configuration-verified and synthetic.

The two historical rules count exact security candidates for the same agent. Ordinary same-host events cannot fill their thresholds. The kernel-loading predicate no longer treats an absent executable path as proof of an untrusted extension, and excluded-process comparisons require a present process. All adversary roles remain origin and grouping consumes the produced host/process fields.

Validation: 99 synthetic raw scenarios in three pipeline orders, native positive and benign negative examples for every rule, 42 positive predicate/grouping cases, two actual SDK history tests against a localhost OpenSearch mock, shared schema/CEL/raw-JSON contracts, and a private replay of the 30 sampled records. The bounded replay produced zero candidates; this does not establish false-positive rates. An independent schema/consumer review found no additional concrete blockers.

This is offline parser modeling plus actual SDK execution, not closed EventProcessor or live-alert validation. Activating message consumers can increase candidate volumes and new host grouping can consolidate alerts. Filter/rules must roll out together; new history fields require window warm-up. Per-rule staging volumes, identity grouping and actual alerts remain pending. Legacy resource-path heuristics lack native producer evidence and remain explicitly unexercised. Remaining lastEvent grouping depends on the separately reviewed #2590 rollout.

Draft only, targeting official utmstack/UTMStack v11. No customer configuration was changed and nothing was merged or deployed. Customer payloads are excluded; details and sources are in filters/audits/macos.md.