fix(nist-ir): ship SOC Analysis_V3 without aiTask nodes

[scottbrumley]

aiTask nodes cannot ship as pack content — the SDK cannot export them and the public API cannot reach them, so they are tenant-only and un-versioned. They also crash SOCFWPackManager, which installs via demisto-sdk upload_content_entity inside demisto/demisto-sdk:1.38.14 (pydantic: aiTask not a valid enumeration member). That is what forced the v1.8.0 pin in #1048.

This replaces SOC Analysis_V3 with the tenant-verified copy: 23 tasks -> 15, no aiTask nodes. DCs add the aiTask per-tenant and bind it to their own prompt, since aiTaskId is tenant-local and does not travel.

system: true restored — the tenant export does not carry it and normalize_contribution.py does not add it back.

Verified on a tenant

Gate green with upload against both deathstar and brumxdr. Confirmed landed on brumxdr by downloading the playbook back (15 tasks, no aiTask).

Replayed scenarios/turla_carbon_abnormal_mde.yml (1 Abnormal + 144 Defender) on deathstar with SOCExecutionList_V3 on default:

• raw landed — abnormal_security_email_protection_raw, msft_graph_security_alerts_raw
• both correlation rules fired; full Turla endpoint chain across 3 hosts
• cross-source grouping held — ENDPOINT 102 + EMAIL 1 on one case
• category routing correct — Endpoint 350 / Email 1 execution rows; soc-get-email-forensics fired once on the Email branch
• Universal Command dispatched: soc-enrich-endpoint, soc-enrich-user, soc-enrich-device-logons, soc-enrich-file (success)
• playbooks reached completed

Not proven

• Nothing reached Containment/Eradication/Recovery, so shadow_mode_state is not_applicable throughout — shadow mode is not exercised by this change.
• Enrichment returning data is untestable on these tenants; integration_unavailable rows are the expected no-integration path (Unsupported Command (23)).

Behaviour change to be aware of

SaaS and Workload branches are not present in this copy, so alerts in those categories fall through Product Category to #default#. Deliberate, and independent of the aiTask issue.