validate.py: flag MITRE trigger fields that release rejects on the NG-SIEM trigger

[mraible]

Trigger discovery — search_triggers, surfaced by trigger_search.py --fields — advertises Trigger.Detection.MitreAttack.Tactic and .Technique on the Investigatable/NGSIEM trigger, but the release validator rejects them as unknown variables. They are not on the NG-SIEM trigger payload at release time. Import and validate_only both pass, so a model that follows the tool's own field list produces a workflow that fails only at release.

Two coordinated changes:

• validate.py now flags Trigger.Detection.MitreAttack.Tactic/.Technique when the workflow uses the NG-SIEM trigger. It is scoped to that event (the existing NG-SIEM guard early-returns for other triggers), so EPP and base-Investigatable workflows — which may legitimately carry these — are untouched. The message points at sourcing MITRE from the hydrated detection instead.
• trigger_search.py --fields marks those two fields "NOT release-valid" so the discovery tool stops steering authors toward a field that fails at release — fixing the root cause, not just catching it after.

This follows the same evidence-based pattern as the other NG-SIEM release-only guards (Trigger.Detection.Product/Description, the Trigger.Category.Investigatable.* namespace, the list-vs-string CEL guard).

Also folds in a small bundle-tooling fix: release.sh --bundle's link check now recognizes a markdown link that carries a #section anchor (](ref.md#heading)), stripping the anchor before resolving so a bundled file referenced only through an anchored link cannot be silently dropped from the archive.

Verification: catches the real workflow that failed a release-gated eval on both MITRE references; 545 tests pass including four new cases (guard fires on the NG-SIEM trigger, stays silent on EPP; the tool annotates on NG-SIEM, not on other categories); pylint 10/10 (max-module-lines 1200 → 1300 to fit the guard); release.sh is shellcheck-clean and the anchored-link resolver is proven on a fixture (ref.md#heading resolves, a genuinely missing target is still reported).