Add Detection Validation & Adversarial Simulation Frameworks section

[GnomeMan4201]

Summary

This PR adds a new top-level section to 02 - Attack Strategies.md covering frameworks for generating adversarial-shaped telemetry in controlled environments.

Motivation

The existing file covers attack strategies and agentic attack surfaces well, but has no coverage of the tooling layer that practitioners use to validate detection against those attack strategies. This is a meaningful gap — detection validation frameworks are a direct output of red-team research and are increasingly cited alongside attack taxonomy work.

What's added

## Detection Validation & Adversarial Simulation Frameworks

A new top-level section with one subsection:

### Synthetic Telemetry Generation

Covers tools that simulate the behavioral signatures of adversarial techniques — producing structured, inert telemetry artifacts that map to ATT&CK techniques — without executing payloads or exploits.

Entry: SHENRON (GnomeMan4201 / badBANANA Research Collective, 2025)

• Repo: https://github.com/GnomeMan4201/shenron
• Article: https://dev.to/gnomeman4201/observable-adversarial-behavior-not-portable-adversarial-procedure
• Polymorphic adversarial simulation framework generating inert ATT&CK-mapped telemetry across multi-stage kill chains
• Supports Sigma rule testing, SIEM/EDR behavioral validation, SOC tabletop exercises
• Introduces a stealth scoring model for quantifying detection surface per technique

Relationship to existing PR #6

PR #6 (open) adds agentic attack surface taxonomy. This PR adds a separate category — detection validation tooling — and does not conflict with or depend on #6.