Document shellcode execution via ReadDirectoryChanges

## Prerequisites

* [x] Put an X between the brackets on this line if you have done all of the following:
* Checked that your rule idea isn't already filed: [search](https://github.com/mandiant/capa-rules/issues?q=is%3Aissue+is%3Aopen+)

## Summary

`ReadDirectoryChanges` accepts an `lpCompletionRoutine` which triggers the specified routine when the targeted directory content has been modified in some way (i.e., a file has been created, renamed, deleted, etc.). This can be abused to trigger a shellcode execution similar to other existing callback-based shellcode execution methods.

Either a new rule needs to be written, or a rule can be added in place of `load-code/shellcode/execute-shellcode-via-windows-callback-function.yml` if it is still considered within the same scope of the rule.

## Examples

## Features

`api`

## Additional context

https://osandamalith.com/2025/09/25/executing-shellcode-with-readdirectorychangess-hidden-callback/
https://github.com/OsandaMalith/CallbackShellcode/blob/main/ReadDirectoryChanges.c

## Rule details

### Namespace

### References

### Other rule meta information

Start by reading load-code/shellcode/execute-shellcode-via-windows-callback-function.yml and the linked ReadDirectoryChanges.c example, then compare the proposed API behavior with the existing rule's scope. Done means deciding whether to extend that rule or define a new rule that detects this shellcode-execution technique, with appropriate rule metadata and validation examples.

Written by the indexing model from the issue text.