docs(mappers): time no longer dates detection

Eight mappers (Cortex XDR, CrowdStrike, Rapid7) still called the OCSF
`time` field "the MTTD anchor" that Riposte reads to stamp detected_at.
Riposte retired MTTD in migration 0256 and stamps detection at
ingestion for every alert; the mappings stay, as the alert's own record
of when the source saw the event. Comments only: no mapping changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

integrations/crowdstrike/mappers/search_detections.yaml

@@ -27,11 +27,9 @@ ocsf:
   - { source_path: "name",               ocsf_field: "finding_info.title" }
   - { source_path: "description",        ocsf_field: "finding_info.desc" }
   - { source_path: "created_timestamp",  ocsf_field: "finding_info.created_time" }
-  # `time` is the MTTD anchor: the ingestion engine reads THIS field and no other
-  # to stamp detected_at. Without it the incident is anchored at ingestion, so the
-  # delay between Falcon detecting and Riposte collecting — over a day on a slow
-  # poll — is measured as zero. finding_info.created_time below does NOT serve
-  # this: it is the finding's own record of the same instant, read by nothing.
+  # `time` is the OCSF event time: when Falcon raised the alert.
+  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
+  # it is the alert's own record of when the source saw the event.
   - { source_path: "created_timestamp",  ocsf_field: "time" }
   - { source_path: "updated_timestamp",  ocsf_field: "finding_info.modified_time" }
   - { source_path: "scenario",           ocsf_field: "finding_info.analytic.name" }