New: five audience-specific demos (SOC, threat intel, detection eng, IR, hunting)

[cognis-digital]

The repo now ships five runnable, audience-specific demos under demos/. Each one loads a real bundled telemetry fixture, runs the actual c2detect engine fully offline (no network, no fabricated output), prints narrated output, and exits 0 — so they double as smoke tests for the public API.

PYTHONUTF8=1 python demos/run_all.py

#	Scenario	Audience
1	01_soc_triage.py	SOC / blue team — prioritize a JARM egress sweep
2	02_threat_intel_feeds.py	Threat intel — abuse.ch Feodo + SSLBL enrichment, offline
3	03_detection_rules.py	Detection engineers — generate Sigma + Suricata
4	04_incident_response.py	IR / DFIR — attribute a 4-framework intrusion
5	05_campaign_correlation.py	Threat hunters — cluster hosts into campaigns

Full write-ups are in docs/DEMOS.md and the engine walkthrough (with mermaid diagrams) in docs/ARCHITECTURE.md. Feedback on which audiences/scenarios you'd like covered next is welcome.