Add custom workspace rules via [rules] paths in the root manifest

Projects can now define their own Starlark rules checked into the repository by adding a [rules] table to the root once.toml with paths pointing to rule files. These workspace rules are loaded alongside the built-in prelude and are used across once query rules, once query schema, validation, the MCP server, edit operations, and graph analysis. Changes to rule files also participate in the action cache input digest, so builds are invalidated when the rules that generate them change.