Use when a new MCP/agent-supply-chain attack or worm is disclosed (e.g. another Miasma/ClawHavoc). Produces the analysis-to-rule pipeline.
