Fix pySigma RE2 compatibility in fresh installations

VALIDATION.txt

@@ -162,3 +162,18 @@ source mapping and validation results remain outside the public release.
 A subsequent presentation correction exposes original-file SHA-256 matches in
 SUMMARY.txt even without an event match. Three focused presentation tests passed,
 including this separate hash-only case; Ruff, formatting and strict mypy passed.
+
+DEPENDENCY COMPATIBILITY FIX — 2026-10-05
+
+Version 1.0.0 was installed in an isolated environment with pySigma 2.0.0.
+The bundled-rule validation reproduced the reported RE2 rejection of lookahead
+syntax. Version 1.0.1 constrains pySigma to >=1.5.1,<2, keeping the existing
+detection patterns and timeout-protected matching unchanged.
+
+Reinstalling the corrected package in that same environment automatically
+replaced pySigma 2.0.0 with 1.5.1. All 47 bundled Sigma rules validated, with
+246 explicit active indicators. All 138 tests passed against the installed
+package with Python warnings treated as errors. A new regression checks the
+reported lookahead pattern against raw and decoded text, including negative
+cases. Ruff lint, formatting and strict mypy across source and tests passed.
+This verification did not rerun the complete private forensic datasets.