Verify the actual files in a declared Wazuh rule set

[Brad-Edwards]

The audited pack declared 11 files but supplied one XML file containing 11 rules. Existing placement checks did not independently count the guest files.

Done when

• Observe corpus file inventory separately from XML definition counts using the released runtime contract.
• One file with multiple rules counts as one file; tests cover missing/extra files and inadequate observations.
• Report unsupported or unverified checks honestly. Never copy planned values into an observation.
• Keep configuration verification separate from whether the in-world detector detects an attack; correct pack declarations upstream.

Historical baseline: APTL dev 28afe66, RAES 3.3.0, env-packs 4.0.2. Newer contracts strengthened the requirement; check the selected release before implementing. No general observation framework is required for this concrete gap.

Related: OpenRAE/env-packs#343; #877, #870.