represent ECVC and SCVS state with persistency (#255)

[viktorbeck98]

Task

Closes #255.

Description

• ECVC re-derives its model. post_train's body moved to _derive(), called
  after training and after a load. It sorts the vectors first: restored keys are
  strings whose set iteration order is hash-randomized per process, and the seeded
  shuffle splits train from validation by that order. The sort is what makes a
  restored model equal a freshly trained one.
• Keys carry the window size. A count vector's length is max(EventID) + 1
  and says nothing about the window it was counted over, so restoring state at a
  different window_size used to mean every vector missed and every window
  alerted. It now logs a warning.
• ECVC holds its vectors permanently. post_train used to free train_seqs;
  it can't now — those vectors are the persisted model. Memory grows with the
  number of distinct training windows.
• Shared helpers moved to utils/sequence_encoding.py so no detector imports
  from another. Consequence: build_count_vec is no longer importable from
  scvs_detector. ECVCOp.build_count_vec is unchanged.

How Has This Been Tested?

pytest --run-ignored — 700 passed, including the ECVC and SCVS audit.log
end-to-end regressions, which detect the same log IDs as before. New coverage in
test_persist_integration.py: save/reload per detector, codec round-trip, the
window-size warning, and an assertion that a reloaded ECVC matrix and threshold
match a trained one

Checklist

• This Pull-Request goes to the development branch.
• I have successfully run prek locally.
• I have added tests to cover my changes.
• I have linked the issue-id to the task-description.
• I have performed a self-review of my own code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}