Sigma to KQL conversion experiments

Conversion notes with emphasis on field mapping reliability, fallback logic, and reviewer verification points.