feat(rulings): a command or edit touching an area's files shows its rulings, once per session (milestone 444 step 4, #4757)

A System's rulings (the Rulings section of its description) now reach the
work by path, not by similarity. Both PreToolUse arms resolve the files a
command or edit names to the Systems whose path_patterns cover them, and the
first touch in a session shows each area's rulings in one line; a repeat is
a one-line reference. A lookup, so no floor, no budget, no retrieval_logs row.

- services/system_rulings: parse_rulings, command_paths (reads and writes,
  relative to the repo root from any cwd; flags, URLs, globs skipped),
  rulings_for_paths
- /tool-rules takes root, cwd and seen_ruling_systems; /prior-art takes
  seen_ruling_systems; both return ruling_system_ids
- hooks share <sid>.rulings.ids (cleared on compaction by the ledger naming
  convention); the Bash hook sends the repo root and cwd
- system_usage_events (migration 0114): surfacings by source, pulls from
  get_system; carried by backup (v20) through the system map
- writing-records: rulings also arrive when the area's files are touched

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/scribe/routes/plugin.py

@@ -194,8 +194,18 @@ async def pre_tool_rules():
                                   different claims about the reader's
                                   context, so they get different lines
                                   (#4100).
+        root, cwd (opt)         — the repo's absolute root and the command's
+                                  working directory. They turn the paths the
+                                  command names into repo-relative ones, for
+                                  the rulings arm (milestone 444).
+        seen_ruling_systems (opt) — comma-separated System ids whose rulings
+                                  were already shown this session, by either
+                                  arm; those get a one-line reference. SHARED
+                                  with /prior-art, like exclude_rule_ids.
 
-    Returns `context`, `rule_ids`, and `checkpoint` (#4214, milestone 419).
+    Returns `context`, `rule_ids`, and `checkpoint` (#4214, milestone 419),
+    plus `ruling_system_ids` — the Systems whose rulings were shown in full on
+    this call — when there were any.
 
     `checkpoint` IS THE ONE PART OF THIS RESPONSE THAT IS NOT A HINT. It is
     empty on almost every call. When present it carries `rule_id`, `title`,
@@ -221,6 +231,9 @@ async def pre_tool_rules():
     result = await plugin_ctx_svc.build_tool_rule_hint(
         g.user.id, tool, command,
         project_id=project_id, exclude_rule_ids=exclude_rule_ids, held_rule_ids=held_rule_ids,
+        root=(request.args.get("root") or "").strip(),
+        cwd=(request.args.get("cwd") or "").strip(),
+        seen_ruling_systems=_int_list(request.args.get("seen_ruling_systems")),
     )
     return jsonify(result)
 
@@ -265,6 +278,10 @@ async def write_path_prior_art():
                              or `canon:<snippet_id>`) already named this
                              session by the ledger arm (#2900); its own
                              channel, like the two above.
+        seen_ruling_systems (opt) — System ids whose rulings were already shown
+                             this session (milestone 444); shared with
+                             /tool-rules. The response's `ruling_system_ids`
+                             are the ones shown in full on this call.
         (Returns a `checkpoint` block on the same contract as /tool-rules —
         see that endpoint. The write-path HOOK deliberately does not act on
         it: scribe_prior_art.sh carries a tested property that it never
@@ -306,6 +323,7 @@ async def write_path_prior_art():
         repo_key=repo_bindings_svc.normalize_repo_key(repo) if repo else "",
         exclude_derive=exclude_derive,
         exclude_rule_ids=exclude_rule_ids, held_rule_ids=held_rule_ids,
+        seen_ruling_systems=_int_list(request.args.get("seen_ruling_systems")),
     )
     return jsonify(result)