Explainable Malware Detection from Noisy API Sequences with RAG-Based MITRE ATT&CK Mapping