Add custom workspace rules via Starlark files

Once now supports custom workspace rules written in Starlark. Add a [rules] section to the root once.toml with paths like paths = ["rules/*.star"] so your own rule files are loaded alongside the built-in prelude. These rules participate in once query rules, once query schema, validation, MCP schema tools, and graph analysis. Because the rule source is included in the declared action cache input, builds are correctly invalidated when your custom rules change.