feat(rules)!: retire rulebook subscriptions and per-project suppressions (#4052)

A rule's home is its scope now: a rule in a rulebook topic is global, a rule on
a project applies to that project, and retrieval reads that directly (#4074).
A subscription had stopped changing anything a session received; a suppression
muted rules from a subscription. Operator, 2026-09-15: "we have global and
project scoped rules, we don't need the subscriptions now."

What goes, whole (rule 22):
- Migration 0101 drops project_rulebook_subscriptions, project_rule_suppressions
  and project_topic_suppressions, and strips subscribe_rulebooks (and 394's
  leftover exclude_always_on_rulebooks) from stored inception choices.
- Service, MCP and REST: subscribe/unsubscribe and the four suppress/unsuppress
  operations. The Subscribers checklist, the subscribe chips, the skip buttons
  and the Suppressed section in the rules UI.
- Inception asks two questions (design system, seed Systems). create_project and
  decide_project_inception lose subscribe_rulebooks.
- Backup v15 stops exporting the three sections; older archives still restore,
  the keys simply unread. Trash no longer hard-deletes suppression rows.

What changes meaning:
- get_applicable_rules is a project's LISTING: its own rules, plus the global
  rules tagged to an area it works in. Untagged global rules apply everywhere
  and arrive by retrieval, so they are not listed. A co_surfaces partner on a
  different project is not dragged in.
- list_rules(project_id) lists that project's own rules.
- rules_payload drops subscribed_rulebooks and suppressed_*; the handshake's
  brief form is project_rules alone.
- using-scribe's "Where a new rule goes" and inception sections, tool
  docstrings and docs say global vs project. Plugin 2026.09.15.1620.

Milestone 414 step 2.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

tests/test_services_backup.py

@@ -249,11 +249,7 @@ def test_the_column_guard_covers_every_table_with_a_row_helper():
     # REAL table names, as _BACKED_UP holds them — not the shorter keys the
     # payload uses for the same sections. Getting this wrong is what the guard
     # caught on its own first run.
-    join_tables = {
-        "project_rulebook_subscriptions", "project_rule_suppressions",
-        "project_topic_suppressions",
-        "rule_systems",
-    }
+    join_tables = {"rule_systems"}
     covered = set(_column_guard_targets()) | join_tables
     assert set(backup._BACKED_UP) - covered == set()
     # And no stale entries: every declaration must name a real target.
@@ -306,15 +302,6 @@ def test_every_table_is_either_backed_up_or_explicitly_excluded():
     )
 
 
-def test_join_table_row_helpers_are_pure():
-    subs = [SimpleNamespace(project_id=1, rulebook_id=2)]
-    rsup = [SimpleNamespace(project_id=1, rule_id=9)]
-    tsup = [SimpleNamespace(project_id=1, topic_id=7)]
-    assert backup._subscription_rows(subs) == [{"project_id": 1, "rulebook_id": 2}]
-    assert backup._rule_suppression_rows(rsup) == [{"project_id": 1, "rule_id": 9}]
-    assert backup._topic_suppression_rows(tsup) == [{"project_id": 1, "topic_id": 7}]
-
-
 class _Result:
     def scalars(self):
         return self
@@ -350,8 +337,6 @@ async def test_export_full_backup_contains_every_declared_section():
     # The sections v2 silently dropped, the six v5 added, v6's
     # note_supersessions, and v7's code_shapes (all empty here).
     for key in ("rulebooks", "rulebook_topics", "rules",
-                "rulebook_subscriptions", "rule_suppressions",
-                "topic_suppressions",
                 "systems", "record_systems", "design_systems",
                 "design_tokens", "note_usage_events", "repo_bindings",
                 "note_supersessions", "code_shapes", "code_shape_events",