Add firewall hit counter evidence gates

[yanziwei]

Summary

• add hit-counter freshness evidence requirements to firewall-review unused rule detection
• require counter baseline, uptime/policy install, failover/reset history, flow-log cross-checks, and owner/ticket evidence
• add an Unused Rule Evidence output table with evidence quality and disposition fields

Validation

• git diff --check
• Markdown fence-balance check
• marker checks for hit-counter, Counter Baseline, Unused Rule Evidence, and failover/reset history

Notes

This keeps the change scoped to the existing unused-rule section. It does not overlap with broader effective-rule or egress-filtering work.