rules: anchor features offset to section header in rule formatter

[SkxOverKill]

Summary

Fixes #3134 by preventing Rule.to_yaml() / capafmt from corrupting rules whose namespace contains the substring features, such as impact/features/persistence.

Relationship to #3135

This PR is functionally a duplicate of the earlier #3135: both address #3134 by anchoring the formatter's search to the actual top-level features: section and both add regression coverage for a metadata description combined with a features namespace.

#3135 predates this PR and has already received maintainer approval. This PR is retained only as a CLA-compliant fallback because #3135 remains blocked on its contributor's CLA. If #3135 becomes mergeable, this PR should be closed in its favor. Credit to @Makeph for the earlier contribution and analysis in #3135.

Root Cause

The formatter located the start of the features block with:

features_offset = doc.find("features")

Because str.find() returns the first matching substring, a namespace containing features caused the offset to point into rule metadata. The subsequent feature-description indentation adjustment then also modified the metadata description, producing invalid YAML.

Implementation

• Anchor the offset to the top-level YAML section header: \n features:.
• Add a round-trip regression test containing both namespace: impact/features/persistence and metadata/feature descriptions.
• Add the required entry under master (unreleased) in CHANGELOG.md.

Verification

python -m pytest tests/test_fmt.py tests/test_rules.py tests/test_rule_cache.py -q
45 passed in 0.35s

python -m ruff check --config .github/ruff.toml capa/rules/__init__.py tests/test_fmt.py
All checks passed!

python -m ruff format --check --config .github/ruff.toml capa/rules/__init__.py tests/test_fmt.py
2 files already formatted

[github-actions]

Please add bug fixes, new features, breaking changes and anything else you think is worthwhile mentioning to the master (unreleased) section of CHANGELOG.md. If no CHANGELOG update is needed add the following to the PR description: [x] No CHANGELOG update needed

[williballenthin]

@SkxOverKill what is the relation between this PR and #3135?

CHANGELOG updated or no update needed, thanks! 😄

[SkxOverKill]

Thanks for asking. #3143 is functionally a duplicate of the earlier #3135: both fix #3134 by anchoring the formatter offset to the actual top-level eatures: section, and both add regression coverage for a metadata description in a eatures namespace. #3135 predates this PR and is already approved, but it remains blocked on its contributor's CLA. I have updated this PR to acknowledge that relationship and @Makeph's earlier contribution explicitly. I also added the missing changelog entry and revalidated the formatter/rules/cache tests (45 passed), so #3143 is available strictly as a CLA-compliant fallback. If #3135 becomes mergeable, I am happy for this PR to be closed in its favor.