[New Rule] Unusual Child Process of Homebrew's Bundled Ruby Interpreter

### Description

Detects an unexpected child process spawned by Homebrew's own bundled Ruby interpreter (`vendor/portable-ruby`) during a `brew install --cask` operation. Homebrew Cask `preflight`/`postflight`/`uninstall` stanzas run arbitrary Ruby code (including shelling out via `system_command`) at install time. A malicious or compromised cask (from a third-party tap, or a compromised/typosquatted first-party one) can use this to execute code with the installing user's privileges. This is the macOS analogue of the same install-time-hook abuse pattern already covered for npm/Composer/pip elsewhere in this ruleset; Homebrew is macOS's dominant developer package manager and had zero coverage in `elastic/detection-rules` prior to this rule, including no representation in the existing cross-platform package-manager ancestor meta-rule (`344e6c7d-ceb0-4f20-ba04-7c75569a7e38`), which only recognizes npm/pip/cargo.

**Validation**: real end-to-end testing against a macOS Elastic Defend deployment, including a fresh re-test today (2026-08-07). Built a real local Homebrew tap with a cask defining a `postflight` block that shells out (`system_command "/bin/echo", args: [...]`) and captured the real resulting event live. Exclusion list was built and then **twice corrected** from real measurement, not assumption. First, Homebrew's own internal package-management operations (archive extraction, quarantine/xattr handling, symlinking) are indistinguishable at the process-tree level from a cask's own hook code, so a real clean-cask baseline was measured and excluded. Second, a fresh re-test today found Homebrew also spawns a wider set of its own environment/requirement-check utilities (`bash`/`sh`, `getconf`, `mdfind`, `pkgutil`, `xcode-select`) as direct children of the same interpreter on every invocation, regardless of `HOMEBREW_NO_AUTO_UPDATE`/`HOMEBREW_NO_ANALYTICS` (an earlier test pass had incorrectly attributed this noise solely to those settings); these were added to the exclusion list, and it was re-confirmed live via `_eql/search` that the real postflight hook event still matches and this real noise no longer does. This rule is scoped and tested against `binary`-artifact casks only; `app`-artifact casks and formula (non-cask) source builds are documented as untested/out-of-scope in the rule's own `false_positives`.

### Target Ruleset

macos

### Target Rule Type

Event Correlation (EQL)

### Tested ECS Version

8.10.0

### Query

```eql
process where event.action == "exec" and host.os.type == "macos" and
process.parent.executable like~ "*/Homebrew/vendor/portable-ruby/*" and
not process.name in (
"env", "xattr", "chmod", "chown", "tar", "bsdtar", "ln", "hdiutil", "xargs", "defaults", "clang", "sysctl",
"bash", "sh", "getconf", "mdfind", "pkgutil", "xcode-select"
)
```

### New fields required in ECS/data sources for this rule?

None. Uses standard `process.*` fields already populated by Elastic Defend on macOS.

### Related issues or PRs

None.

### References

- https://docs.brew.sh/Cask-Cookbook#stanza-preflight
- https://docs.brew.sh/Cask-Cookbook#stanza-postflight

### Redacted Example Data

Real event captured today (2026-08-07), the actual cask postflight hook firing:

```json
{
"@timestamp": "2026-08-07T17:0x:xx.xxxZ",
"host": { "os": { "type": "macos" } },
"process": {
"name": "echo",
"executable": "/bin/echo",
"args": ["/bin/echo", "s33r-cask-postflight-marker"],
"parent": {
"name": "ruby",
"executable": "/usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/4.0.6/bin/ruby"
}
}
}
```

False-positive control from the same real install run (all correctly excluded by the current query, 16 distinct legitimate process names observed as children of the same interpreter during one ordinary cask install, none matched): `env`, `xattr`, `chmod`, `bsdtar`, `hdiutil`, `xargs`, `defaults`, `clang`, `sysctl`, `ln`, `bash`, `sh`, `getconf`, `mdfind`, `pkgutil`, `xcode-select`.

Start with the supplied EQL query and the repository's existing macOS Event Correlation rules, then compare their metadata and ECS usage with this rule's process exclusions. Done means the rule detects the described binary-cask postflight event while excluding the measured Homebrew process noise and documenting the stated out-of-scope cases.

Written by the indexing model from the issue text.