[pournasserian]

Closes #2634

What

The first slice of F-RUL (#2419), RUL-01 to RUL-03: the rule book, with rules stored as versioned content and published through change sets. It builds on the change set writes of #2520 (SCH-05).

• Core (FluentCMS.Core.Rules):
  • RuleDefinition holds four things, stored as one JSON document (ADR-0005), with Validate saying what to change:
    • a kind: voice and style, factual, structural, or permission and routing
    • the rule's text
    • a severity, block or warn
    • a scope of content types, fields and locales; the locale slot is kept and nothing reads it in M1
  • Rule: a slug, a latest version and an active version. Its state is draft, active or retired, and only publishing moves it.
  • IRuleDirectory:
    • reads: the list, the latest version, the active version, and any version
    • writes, each into a ChangeSetTarget: create, revise (from the latest, the active, or the version the set already proposes) and retire
  • ItemDiff.ForRule: the kind, text, severity and each scope list, before and after.
• Infrastructure:
  • Rules and RuleVersions tables, with migrations for SQLite and PostgreSQL; the definition is jsonb on PostgreSQL.
  • RuleDirectory writes as ContentTypeDirectory does: every expected failure is found before the unit of work, and the version, its rule.created or rule.revised event and the change set operation commit together.
    • A second revision in the same set extends the rule's operation.
    • A retirement is a delete operation from the active version.
  • ChangeSetDirectory handles rule items:
    • resolving an operation, and refusing one from an agent or an engine
    • publishing: the active version and the state move together, and rule.published or rule.unpublished is logged
    • reverting, through the inverse operations
    • the diff
• CONTRIBUTING.md: the rule book.

Why

RUL-01 makes rules content: written, versioned, reviewed and published through change sets like everything else. The next slices propose checks from a rule and read the rule book for agents, and both need a rule to have versions and an active one.

Choices worth a look:

• State follows publishing. A rule is a draft until a published set makes a version active, and retired once a published set retires it, as content types and entries are. Reverting a retirement makes it active again, at the version it had, and reverting the set that created it makes it the draft it was.
• Only a person writes rules. The epic says any administrator writes and activates rules in M1. An agent reads the rule book in a later slice. An agent or engine is refused in the directory, and also when it puts a rule operation in a set directly.
• Severity reuses CheckSeverity, since the checks proposed from a rule take its severity.
• No tools or screens yet. The rule book tool and resource come with RUL-06, and the desk shows rules with RUL-05.
• Not in this PR: proposing checks (RUL-04), enforced and advisory labels and the agent read (RUL-05, RUL-06), flagging instruction-like rule text (RUL-07), and proposing a rule from the desk (RUL-08).

Tests

Unit:

• A definition round-trips through its stored document.
• Each kind has a stored name.
• A new rule is a draft at version 1.
• A rule that cannot be held lists each problem.
• A revision builds on the latest or the active version.
• A stored document that is not a rule says why.

Integration, each on SQLite and PostgreSQL:

• A rule is a draft until its set publishes it, then active at version 1. Its operation and events are recorded, and publishing logs rule.published.
• Two revisions in one set extend its operation to version 3, and version 1 stays active until the set publishes. The diff shows the text, severity and scope changes.
• A retirement retires the rule once published; retiring a retired rule is refused; reverting the retirement makes it active again.
• Reverting the set that created a rule makes it a draft again, not retired.
• An invalid rule (kind, text and severity), a taken slug, an unknown rule and a stale base version are refused, and nothing is stored. A stored document with an unknown severity is refused when read.
• An agent and the check engine are refused every rule write, and an agent's rule operation in its own set is refused.

The full suite ran locally against a postgres:17 container as well as SQLite, and markdownlint passes. No new package. This PR adds no IContentTypeDirectory.CreateAsync or ReviseAsync call.

Checklist

• Linked to an issue a maintainer has confirmed
• Targets v2
• Tests or docs updated where behaviour changed