Load custom Starlark rules from workspace paths

You can now define your own Starlark rules inside a workspace and have Once load them everywhere it uses built-in rules. Add a root-level [rules] table to your once.toml and point paths at your checked-in .star files. Those rules are then picked up by once query, the schema inspector, the once edit manifest editor, the MCP server, and graph analysis, and their source is included in action cache inputs so builds invalidate correctly when rules change.