feat(moments): mounted rules arrive when their moment happens, through every door (milestone 458 step 4a, #4922)

A rule mounted on a moment now reaches the session when an act reaches
that moment, with no semantic match involved:

- run_moment_arm on the pipeline: a lookup, not a ranked search. Each
  line names the moment and the act that reached it ("at work.deliver,
  reached by `git push`"), so a misfire is visible where it lands and
  can be unmapped in-session. A repeat is cited, not quoted; fresh
  rules are recorded surfaced under source moment_rule with the moment
  in detail. No retrieval_logs row, as for the other lookups, so no
  latency is persisted for this arm.
- rule_scope: a rule's home clause, moved out of semantic_search_rules
  so the moment lookup scopes by the same one.
- rulebooks.rules_on_moments / mounted_moments.
- The plugin door: a catch-all PreToolUse hook (scribe_moment.sh). It
  keeps /moment-tools' answer on disk for five minutes, so a call to a
  tool that cannot reach a mounted rule sends nothing, and an install
  that has mounted nothing sends one request per window. It shares the
  rules ledger with the other arms and fails open silently.
- The MCP door: Scribe's own tools named by the shipped mappings carry
  moment_rules in their response, so a client without the plugin gets
  them too. The hook skips those tools. A guard pins the attach on
  every one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/scribe/services/embeddings.py

@@ -1528,8 +1528,8 @@ async def semantic_search_rules(
 
     Returns an empty list if the embedder is unavailable or on any error.
     """
-    from scribe.models.project import Project
-    from scribe.models.rulebook import Rule, Rulebook, RulebookTopic
+    from scribe.models.rulebook import Rule
+    from scribe.services.rule_scope import joined_to_homes, rule_home
 
     # See the sibling search: stamped before anything can return (#3765).
     if report is not None:
@@ -1545,30 +1545,23 @@ async def semantic_search_rules(
     distance = RuleEmbedding.embedding.cosine_distance(query_vec)
 
     try:
-        # topic_id XOR project_id (migration 0059), so a rule matches exactly
-        # one arm of whichever clause applies. Inside the try: the access
-        # check reads the database too, and this function fails open.
-        global_rule = Rulebook.owner_user_id == user_id
-        if everywhere:
-            home = or_(global_rule, Project.user_id == user_id)
-        elif project_id and await can_read_project(user_id, project_id):
-            home = or_(global_rule, Rule.project_id == project_id)
-        else:
-            home = global_rule
+        # The home clause is shared with the moment lookup (rule_scope).
+        # Inside the try: the access check reads the database too, and this
+        # function fails open.
+        home = await rule_home(user_id, project_id, everywhere=everywhere)
 
         async with async_session() as session:
             rows = (await session.execute(
-                select(
-                    Rule,
-                    distance.label("distance"),
-                    RuleEmbedding.chunk_index,
-                    RuleEmbedding.chunk_text,
+                joined_to_homes(
+                    select(
+                        Rule,
+                        distance.label("distance"),
+                        RuleEmbedding.chunk_index,
+                        RuleEmbedding.chunk_text,
+                    )
+                    .select_from(RuleEmbedding)
+                    .join(Rule, RuleEmbedding.rule_id == Rule.id)
                 )
-                .select_from(RuleEmbedding)
-                .join(Rule, RuleEmbedding.rule_id == Rule.id)
-                .outerjoin(RulebookTopic, Rule.topic_id == RulebookTopic.id)
-                .outerjoin(Rulebook, RulebookTopic.rulebook_id == Rulebook.id)
-                .outerjoin(Project, Rule.project_id == Project.id)
                 .where(
                     Rule.deleted_at.is_(None),
                     # No threshold predicate — see the note above