Add packaged DLP broker and protected Windows service foundation

docs/broker-siem.md

@@ -17,6 +17,12 @@ events. The standard `outcome` field reflects unknown authorization or failure;
 Microsoft documents its mapping to `EventOutcome` in
 [CommonSecurityLog](https://learn.microsoft.com/en-us/azure/sentinel/cef-name-mapping).
 
+Typed download records use `download.scan` / `download.block` with the original
+request authorization UUID and real file size, magic-derived type and SHA-256.
+They never attach a generic request-body hash. A blocked download has a failure
+outcome and a denied event type. A successful scan reports inspection success;
+it does not prove that the user received or saved the file.
+
 These format and exporter tests do not establish a customer's remote SIEM
 deployment, retention, key custody or incident-response configuration. Production
 browser-to-broker integration remains a separate acceptance gate.