docs(mappers): MTTD is not retired, only re-anchored

The previous commit said MTTD was retired. Migration 0256 did retire it,
but 0257 restored it at once: what stays is its anchor, the moment
Riposte records the alert. The OCSF `time` field is still not read to
date detection — that part was right.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

integrations/rapid7-insightidr/mappers/query_log_set.yaml

@@ -41,8 +41,9 @@ ocsf:
   - { source_path: "detection_name", ocsf_field: "finding_info.analytic.name" }
   - { source_path: "$fromMillis(timestamp)", ocsf_field: "finding_info.created_time" }
   # ── Event time (OCSF `time`) ───────────────────────────────────────
-  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # it is the alert's own record of when the source saw the event.
+  # Riposte no longer reads it to date detection: since migration 0256, MTTD
+  # starts when Riposte records the alert. It is the alert's own record of when
+  # the source saw the event.
   # The log's own timestamp, not the poll's.
   - { source_path: "$fromMillis(timestamp)", ocsf_field: "time" }
   # ── Product identity ──────────────────────────────────────────────