A detection engineer deploys an updated version of a multi-event YARA-L rule that adds a stricter join condition to reduce false positives. Two days later, the SOC reports that a known active detection use case (which previously fired correctly) has gone completely silent, and leadership wants the prior detection coverage restored immediately while the engineer investigates the regression. Which action best follows Google SecOps detection rule lifecycle best practices?