Workspace rule paths let you share custom target kinds

You can now declare custom Starlark rules at the workspace root, and Once loads them into query, MCP, graph, and edit workflows. This lets teams share project-specific rules without relying on built-in target kinds. Rules are also included in declared action cache inputs, so edits to custom rule files correctly invalidate cached results. The root-level once.toml can include a [rules] table with paths such as rules = ["rules/*.star"].