feat(rules): detect composite read exfiltration

[limaronaldo]

Summary

• register SHIELD-020 as a contextual scanner rule without changing the public target-only RuleEngine contract
• emit a high-confidence finding only for complete tool-scoped arbitrary-read-to-HTTP-payload chains
• use semantic source and sink anchors in deterministic evidence and fingerprints
• add scanner-catalog, feature-off, fingerprint-stability, SHIELD-004 coexistence, and end-to-end fixture coverage
• document the twentieth built-in detector and its MCP06 mapping

Why

The composite value-flow graph and contextual transport are already merged.
This PR consumes those precomputed candidates to detect proven arbitrary
file-read exfiltration chains without reparsing source, adding shared state, or
exposing sidecar internals publicly.

Compatibility

• RuleEngine::run and RuleEngine::list_rules remain target-only and coherent
• scanner metadata, CLI, SARIF, and certification include SHIELD-020 through list_scanner_rules
• no public IR or serialization changes
• TypeScript-disabled scans retain targets and emit no SHIELD-020

Validation

• cargo fmt --all --check
• cargo check --workspace --all-targets --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo test --workspace --all-targets --locked — 372 passed
• cargo test --workspace --all-targets --no-default-features --locked — 338 passed

[limaronaldo]

Self-review verdict: no blocking findings. Verified contextual-only registration, complete-chain gating, semantic-anchor fingerprint stability, scanner/public catalog separation, SHIELD-004 coexistence, and TypeScript feature-off behavior. Local gates: fmt, workspace check, all-feature clippy, 372 default tests, and 338 no-default-feature tests all pass. Awaiting remote CI before merge.