docs(exfil): document watch rule schema and pre-push validate

[maximelb]

Summary

A recent support case followed the pattern: customer pushed an Exfil config containing a malformed Watch Rule, the push timed out without surfacing the actual schema error, and they had to wait for a human to diagnose it. The customer's own feedback was "work on the docs and the error handling" — this PR is the docs half.

Changes

In docs/5-integrations/extensions/limacharlie/exfil.md:

1. Watch Rule Fields reference table (under Using the Exfil Extension): per-field type and required/optional flag, with a "common gotcha" callout that path, filters.platforms, and filters.tags must be YAML lists even when they only have one value.

2. Configuration via Hive section: a complete, valid Watch Rule YAML example using the extension_config hive, demonstrating the list form for path and the nested filters block. Matches the pattern already established in the feedback and usage-alerts docs.

3. Validate Before Pushing subsection: documents the limacharlie hive validate --hive-name extension_config --key ext-exfil workflow as the read-only pre-flight check, including what an empty {} response means and the fact that validate never modifies stored config.

No customer-supplied data or identifiers are included; all examples use generic field values.

Test plan

• Render docs locally with mkdocs serve and confirm the new sections appear in the expected order in the left nav
• Verify table renders correctly in the rendered site (some markdown engines disagree on pipe-table alignment)
• Spot-check that the YAML example would actually pass limacharlie hive validate against a current ext-exfil schema

🤖 Generated with Claude Code