[Bug] ES|QL detection rules referencing "process.parent.args" / "process.parent.command_line" fail with verification_exception — fields not populated in ingested data

### Describe the Bug

## Summary
Several Elastic Security detection rules under `system.security` (command line auditing enabled) reference parent-process fields (`process.parent.args`, `process.parent.command_line`) that are not present/mapped in our ingested data. Rather than simply not matching, the rules are erroring out on every execution with `verification_exception`.

## Observed Errors

```
verification_exception
Root causes:
verification_exception: Found 1 problem
line 3:3: Unknown column [process.parent.args], did you mean any of
[process.parent.executable, process.name.text, process.parent.executable.text,
process.executable, process.name, process.name.caseless]?
```
```
verification_exception
Root causes:
verification_exception: Found 1 problem
line 25:5: Unknown column [process.parent.command_line], did you mean any of
[process.command_line, process.parent.executable, process.parent.name,
process.parent.args, process.parent.name.text, process.parent.executable.text,
process.command_line.text, process.name.caseless]?
```

## Environment
- Data source: system.security (command line / process auditing enabled)
- Rules affected: Potential Data Exfiltration Through Curl, Persistence via Update Orchestrator Service Hijack and Proxy Execution via Console Window Host

## Impact
- Affected rules fail on every scheduled run (hard failure, not just zero detections), which will surface as rule execution errors in Kibana and may suppress alerting entirely for these rules.

## Root Cause (working theory)
The data source(s) feeding these indices only capture a subset of parent-process fields — e.g. `process.parent.executable` in one source, `process.parent.args`/`process.parent.name` in another — but never `process.parent.command_line`, and inconsistently `process.parent.args`. This looks like a gap in how command-line audit data is mapped into ECS parent fields for our integrations.

### To Reproduce

1. In Kibana, go to Security → Rules and enable the following detection rule(s) under the `system.security` data view with command line auditing enabled:
- Potential Data Exfiltration Through Curl
- Persistence via Update Orchestrator Service Hijack
- Proxy Execution via Console Window Host
2. Ensure the rule schedule runs.
3. Go to Security → Rules → [rule name] → Execution Results.
4. Observe the rule status shows "Failed" with a `verification_exception`, referencing an unknown column (`process.parent.args` or `process.parent.command_line`).

### Expected Behavior

Either:
1. The ingested events should include populated `parent.*` fields (name, args/command_line, pid, etc.) so existing rules work as designed, or
2. The rules should be adapted/mapped to whatever fields our command-line audit data source actually provides for parent process info.

### Screenshots

_No response_

### Desktop - OS

None

### Desktop - Version

_No response_

### Additional Context

_No response_