Opt-in project rule discovery to prevent repo-controlled command rewrites

[alxxjohn]

Motivation

• Repository-controlled project rules were automatically discovered and could use rewrite.mode: "replace" to substitute arbitrary argv, allowing a malicious checkout to execute attacker-chosen commands when szr was run from that tree.
• The change introduces an explicit trust gate so repository rules are only considered when the user deliberately opts in, preventing silent cross-repository command execution.

Description

• Add a new boolean config flag Advanced.ProjectRules (JSON advanced.project_rules) that is false by default and documents that project rules can rewrite executed commands.
• Short-circuit project-rule discovery in LoadWith unless Advanced.ProjectRules is enabled so repository .szr files are ignored by default.
• Add an interactive settings entry and handler (settingsProjectRulesAction) to let users enable project rules via the settings menu and persist the choice.
• Update documentation and tests to reflect opt-in behavior and to add regression coverage that project rules are ignored by default and can be enabled and persisted; key changes touch internal/config/config.go, internal/cli/settings.go, internal/cli/settings_filters.go, test/config/project_rules_test.go, test/cli/settings_filters_test.go, and docs/ARCHITECTURE.md.

Testing

• Formatted modified files with gofmt before running tests.
• Ran unit tests go test ./test/config ./test/cli ./test/engine ./test/rules and then go test ./..., and all tests completed successfully.
• Added unit tests that assert project rules are not discovered without opt-in and that the interactive setting persists advanced.project_rules, and those tests passed.

---

Codex Task