Update HO-DET-001 public routing proof level

[raylee-hawkins]

Summary

Updates HawkinsOperations .github reviewer routing for HO-DET-001 so the organization profile and control status matrix reflect the current public repo proof level: TEST_VALIDATED_SYNTHETIC_SCOPE.

Evidence basis

• HO-DET-001 source exists.
• HO-DET-001 Splunk source exists.
• HO-DET-001 passed synthetic validation against controlled positive and negative process-creation fixtures.
• The current public repo proof level is TEST_VALIDATED_SYNTHETIC_SCOPE.
• A private controlled lab runtime match has been captured locally, but it is private evidence only and not public proof.

Claim boundaries

This PR updates reviewer routing only. Governance and routing documents remain soft routing unless backed by blocking checks. Website rendering is not proof. Private controlled lab evidence is not public-safe raw proof.

Public-safe requires reviewed wording, privacy review, stale review, evidence linkage review, and Raylee approval.

Explicit blocked claims

• HO-DET-001 is production-ready.
• HO-DET-001 is fleet-wide.
• HO-DET-001 is enterprise deployed.
• HO-DET-001 is Cribl-routed.
• HO-DET-001 is Wazuh-routed.
• HO-DET-001 is public-safe.
• HO-DET-001 public proof is complete.
• Live Splunk fired as public proof.
• Public runtime-active status.
• Public signal-observed status.
• Public evidence-linked runtime proof.

Validation run

• Repository status checked before commit and after commit.
• Whitespace validation passed.
• Only the organization profile start-here file and control status matrix were staged and committed.
• Changed files contain TEST_VALIDATED_SYNTHETIC_SCOPE.
• Changed files preserve NOT_PUBLIC_SAFE or public-safe blocked wording.
• Scoped term scan found no unsafe affirmative claims.
• Content scan found no LAN IPs, Windows local paths, raw CSV filenames, private evidence path tokens, or encoded payload strings.
• Blocked-claim term hits were reviewed and classified as SAFE_BLOCKED_WORDING.

Raw evidence publication

No raw runtime evidence, command lines, payloads, screenshots, LAN IPs, or local artifact paths were published.

Public-safe remains blocked.