Uuid

Idempotent deployment keyed on the Sigma UUID, so a renamed rule updates in place instead of spawning a duplicate. And a –dry-run that never lies about being deployed.