Fix disjunction split across pipeline boundary with deferred regex branch

[Copilot]

When a rule condition is a top-level disjunction and one branch contains a |re modifier, the deferred rex/eval hoisting logic in finalize_query_default incorrectly extracted the first disjunct as a prefix, leaving | search OR ... — invalid SPL that also silently inverts the logic from OR to AND.

Root cause: finalize_query_default greedily matched leading field=value tokens to hoist before the deferred pipeline stages, without checking whether the remaining suffix began with OR (i.e., whether it was splitting a disjunction).

Fix (sigma/backends/splunk/splunk.py):

• After collecting candidate prefix parts, skip hoisting entirely if remaining_query.lstrip().startswith("OR") — keeps the full disjunction intact in the trailing | search clause.

Test (tests/test_backend_splunk.py):

• Regression test for A or (B and not <regex-filter>) shape, asserting \n| search OR never appears and both disjuncts are present in the final search stage.

Before:

Image="*\\hdiutil.exe"
| rex field=CommandLine "(?<CommandLineMatch>...)"
| eval CommandLineCondition=if(isnotnull(CommandLineMatch), "true", "false")
| search OR Image="*\\openssl.exe" NOT CommandLineCondition="true"

After:

| rex field=CommandLine "(?<CommandLineMatch>...)"
| eval CommandLineCondition=if(isnotnull(CommandLineMatch), "true", "false")
| search Image="*\\hdiutil.exe" OR Image="*\\openssl.exe" NOT CommandLineCondition="true"

• Fixes Deferred expressions split a disjunction across a pipeline boundary: '| search OR ...' and an authored OR becomes an AND #74