feat(rules): rule_group/rule_atom (0033), /rules endpoints, evaluation via referenced rule groups

- migration 0033: rule_group (layers, hard excludes, scope, source, revision,
  fingerprint, default_order) and rule_atom; acquisition_slot.rule_group_ids;
  preference tags migrated into rule groups (same id/fingerprint), suppressions
  linked; seeded default groups for acquisition / upgrade / search
- contracts: RuleGroup/RuleAtom/RuleExpr/RuleDefaults, parse/serialize/preview
  schemas; Api.rules, Api.ruleAtoms, Api.rulePolicies, Api.ruleSuppressions
- server: GET/POST/PATCH/DELETE /rules, /rules/{id}/revisions, /rules/{id}/preview,
  /rules/parse, /rules/serialize, /rules/keywords, /rules/defaults, /rules/atoms;
  disable/delete writes suppression, agent re-add -> 409
- /preference-tags now aliases rule groups; /policy-revisions and
  /preference-suppressions kept as aliases of /rules/policies, /rules/suppressions
- evaluateAcquisition resolves slot -> subscription -> default chain (+ upgrade
  defaults) and records pri / rule_group@revision / per-layer trace

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/test/db-sync.test.ts

@@ -112,6 +112,9 @@ const ROWS: Record<string, { row: Obj; dbOnly?: string[]; apiOnly?: string[] }>
   ScheduledJobRun: { row: C.ScheduledJobRun },
   // W7-A Pi 上游(0027):secret_ref 不出 API
   PiUpstream: { row: C.PiUpstreamRow, dbOnly: ["secretRef"] },
+  // W9-D 规则组(0033):legacy_rule 只供旧 /preference-tags 别名回放
+  RuleGroup: { row: C.RuleGroup, dbOnly: ["legacyRule"] },
+  RuleAtom: { row: C.RuleAtom },
 };
 
 /** 引擎自有表(@umt/tasks 内部使用,不经 API 暴露),不要求 Row schema */
@@ -199,6 +202,8 @@ const ENUMS: Record<string, z.ZodEnum> = {
   PolicyRevisionStatus: C.PolicyStatus,
   PreferenceTagKind: C.PreferenceKind,
   PreferenceTagOrigin: C.PreferenceOrigin,
+  RuleGroupKind: C.RuleGroupKind,
+  RuleGroupSource: C.RuleGroupSource,
   PreferenceTagStatus: C.PreferenceStatus,
   ReconcileRunKind: C.ReconcileKind,
   ReconcileRunMode: C.ReconcileMode,