feat(rulings): a command or edit touching an area's files shows its rulings, once per session (milestone 444 step 4, #4757)

A System's rulings (the Rulings section of its description) now reach the
work by path, not by similarity. Both PreToolUse arms resolve the files a
command or edit names to the Systems whose path_patterns cover them, and the
first touch in a session shows each area's rulings in one line; a repeat is
a one-line reference. A lookup, so no floor, no budget, no retrieval_logs row.

- services/system_rulings: parse_rulings, command_paths (reads and writes,
  relative to the repo root from any cwd; flags, URLs, globs skipped),
  rulings_for_paths
- /tool-rules takes root, cwd and seen_ruling_systems; /prior-art takes
  seen_ruling_systems; both return ruling_system_ids
- hooks share <sid>.rulings.ids (cleared on compaction by the ledger naming
  convention); the Bash hook sends the repo root and cwd
- system_usage_events (migration 0114): surfacings by source, pulls from
  get_system; carried by backup (v20) through the system map
- writing-records: rulings also arrive when the area's files are touched

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/conftest.py

@@ -116,6 +116,21 @@ def _no_system_labels():
         yield
 
 
+@pytest.fixture(autouse=True)
+def _no_rulings_arm():
+    """Stub the rulings arm both PreToolUse builders run (milestone 444).
+
+    Autouse for _no_system_labels' reason: every write-path and tool-rule
+    test with a project in scope reaches it, and its first act is reading the
+    project's Systems from Postgres. Stubbed to "no area's files touched".
+    tests/test_system_rulings.py binds the real function at import time,
+    before this patch runs.
+    """
+    with patch("scribe.services.system_rulings.rulings_for_paths",
+               AsyncMock(return_value={"lines": [], "system_ids": []})):
+        yield
+
+
 @pytest.fixture(autouse=True)
 def _no_task_log_arm():
     """Stub the task-log read arm that get_task / list_tasks / get_milestone