Add host activity realism profiles

[DavidJBianco]

Summary

• add overlay-capable host activity profiles for host/role/persona/source scaling
• apply profile-driven volume and artifact variation across baseline endpoint, network, auth, firewall, IDS, web, proxy, syslog, bash, and eCAR activity
• add ASA deny burst/hash realism and update config docs, skill references, TODO, and scenario prompts

Verification

• uv run eforge validate-config
• uv run pytest -v
• uv run pytest -v --include-slow --no-cov (3057 passed, 1 skipped)
• uv run ruff check .
• uv run ruff format --check .

Note: uv run pytest -v --include-slow with default coverage instrumentation hit a stale medium-dataset performance assertion and then became pathological in the coverage + tracemalloc memory pass. The same slow suite passes without coverage instrumentation, and TODO.md now tracks a future speed/efficiency follow-up.