feat(rules): rules/ directory symlinked into ~/.claude like the other dirs

Claude Code loads modular rule files from ~/.claude/rules/ (user scope,
recursive, markdown, optional paths: frontmatter for lazy path-scoped
loading — stable, symlink-supported). The repo had no rules/ at all, so
the ctx7 setup had created ~/.claude/rules as a REAL directory outside
version control — invisible to the repo, unreproducible on a new machine.

- rules/README.md — doctrine: one rule per file; paths:-scoped extraction
  is the token win, always-on doctrine stays in CLAUDE.md
- link.sh — rules added to the symlinked-dirs loop
- .gitignore — rules/context7.md ignored (machine-owned: `ctx7 setup`
  (re)writes it, same treatment as skills/find-docs/)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpphkdTosUzokBDNG7PToS

rules/README.md

@@ -0,0 +1,27 @@
+# rules/
+
+Modular instruction files loaded by Claude Code alongside `CLAUDE.md`.
+Symlinked to `~/.claude/rules` by `link.sh`, same model as `agents/`,
+`skills/`, `lib/`.
+
+## What belongs here
+
+One rule = one file = one concern. Candidates: instructions that are
+self-contained enough to live outside `CLAUDE.md`'s main flow, or that
+tooling generates/owns.
+
+Rules support an optional `paths:` YAML frontmatter (glob list). A rule
+WITH `paths` loads lazily — only when Claude reads a file matching a
+glob; a rule WITHOUT it loads at session start, same cost as CLAUDE.md.
+So: extract from CLAUDE.md only what can be path-scoped (the token win)
+or what is generated; always-on doctrine stays in CLAUDE.md.
+Docs: https://code.claude.com/docs/en/memory.md#path-specific-rules
+
+## Machine-owned files (gitignored, regenerated)
+
+- `context7.md` — written by `ctx7 setup --claude --cli`
+  (install-plugins.sh STEP ctx7). Not vendored: ctx7 owns its content
+  and rewrites it on setup; the repo would fight the generator. Same
+  treatment as `skills/find-docs/`.
+
+Hand-written rules ARE tracked — add them normally.