RFC-007 Phase 2: project rule + rfc nodes behind --nodes (fixes #588)

[lantisprime]

Implements RFC-007 Phase 2 from the review-complete plan at docs/plans/RFC-007-P2-rule-rfc-nodes.md (4 adversarial plan-review rounds) and its frozen mechanical appendix.

What lands

• scripts/lib/rule-nodes.mjs (new): slugify, a flat frontmatter parser returning null-prototype objects, converged rule-directory resolution, and the rule and RFC corpus scans.
• --nodes flag on em-graph.mjs: episode,rule,rfc or all, defaulting to episode. Unknown values exit 2. The new node types surface at --orphans, at --from <rule-id>, and in the traversal response.
• entry_point frontmatter key is parsed and carried on rule nodes. Its --graph-health audit consumption stays Phase 4 and its persisted form stays Phase 6; RFC-007 previously assigned this key to three different phases without reconciling them, and that split is now written down.
• RFC-007 updated: rule and rfc node rows flipped from UNBUILT to SHIPPED, Phase 2 row flipped, OQ-1 resolved, the no-name: skip policy recorded, the narrowed entry_point grammar recorded, and the self-refuting status line at :246 retired.
• New suite tests/test-em-graph-nodes.mjs (28 cases), CI-wired in the same PR.

Decisions recorded rather than invented

RFC-007 left three things unstated or contradictory; each is now written into the RFC:

1. A rule file with no frontmatter name: is skipped and counted, never projected under a filename-derived slug (:133 forbids that). Observed today: 8 files are in this state and all are MEMORY* files, 8 of the 9 members of that glob. MEMORY.md is among them, and :233 names MEMORY.md as a canonical entry-point root, so a canonical root is currently unprojectable. That tension is tracked on RFC doc-coherence batch: RFC-008 stubs, RFC-001 phase headers, RFC-004 missing M1 row, RFC-002 ledger stops at Phase 2 #585.
2. A name: that slugifies to empty (an all-non-ASCII name) is skipped on the same footing. Diacritic folding is deliberately not performed.
3. New node types are opt-in behind --nodes, mirroring how tags is gated outside DEFAULT_EDGES.

Verification

Claim	Command	Observed
New suite green	node tests/test-em-graph-nodes.mjs	28 passed, 0 failed
No regression	node tests/test-em-graph.mjs	10 passed, 0 failed
Suite CI-wired	node tests/test-ci-suite-registration.mjs	16 passed, 0 failed, PASS
RFC coherence	node scripts/em-rfc-validate.mjs	14 RFCs consistent
Write-free	grep -n "writeFileSync|renameSync|mkdirSync" scripts/em-graph.mjs	no output

Both polarities on the same input, which is what proves the flag is not a no-op (it was one at plan-review round 2): --from whats-next-show-non-issue-tasks --nodes rule --scope local returns a real type: "rule" node with skipped_nodes: 8, while the identical command without --nodes exits 1 not-found. The code's own skipped_nodes: 8 matches an independent grep -L "^name:" count exactly.

Review

Frozen-diff review by pi/GLM-5.2 on neuralwatt, round 1 verdict ACCEPT, no BLOCKER and no MAJOR. The reviewer reproduced every axis against isolated fixture corpora: the no-op class at all four surfaces, prototype pollution, symlinked directory and file, readdir determinism, collision exit 2, empty-slug skip, NFC convergence, no-truncation, write-freedom, no-name: skip, and no-rfc_id skip.

Two MINOR findings applied in this PR: --nodes was missing from --help (P5 discoverability), and the slug-collision message duplicated the slug and hardcoded the word Two for 3-or-more colliders.

Two deferred with 5-field justifications: #602 (absolute filesystem path emitted on every node, P6 tension) and #603 (--hubs runs the scan and can exit 2 but suppresses skipped_nodes).

Not in scope

scripts/em-console.mjs still validates --from against an episode-id shape, so rule slugs are rejected there. Left deliberately unwidened.

Ledger provenance note: the Implementation ledger row and Phase 2 row carry a placeholder SHA to be replaced from git log --follow after merge, per the #582 defect class.