Support workspace rule paths

You can now declare custom Starlark rules in the root once.toml under a [rules] section with paths to checked-in rule files. Once loads these workspace rule schemas across query, MCP, the manifest editor, graph loading, and rule analysis, and includes the rule source in the cache inputs for declared actions so that changes to your custom rules invalidate builds correctly.