refactor: remove rules/ - detection rules are implementation artifacts

[chaksaray]

Summary

All 59 files in rules/pattern/ carried a bawbel-namespaced rule_id -- implementation-specific detection code living in a repo whose entire purpose is to be implementation-neutral. ARCHITECTURE.md's own diagram already documented this: rules/pattern, rules/yara, rules/semgrep loading directly into PatternEngine, YARAEngine, SemgrepEngine, named components of one specific scanner.

Investigated moving these into bawbel/scanner per the original plan, decided against it. That repo already has its own independently-authored, more complete detection logic: PATTERN_RULES embedded directly in pattern_engine.py (covering 40 of 59 AVE ids, in a completely different schema -- dicts with title/severity/aivss_score/owasp fields, not the RULE + matches() shape this repo's files used), plus consolidated yara/semgrep rule files covering 39 and 37 ids respectively. Its own 607-test suite passes independent of anything in this repo. Copying rules/pattern/*.py in verbatim would have created dead, unwired files in the wrong format rather than actually integrating with how that engine works -- so no scanner-side PR was opened. rules/ is removed here without a corresponding deposit anywhere.

rules/semgrep/ and rules/yara/ were empty scaffolding (README only, no actual rule files); their READMEs were already generically worded ("AVE records," pointing to CONTRIBUTING.md), not bawbel-scanner-specific.

Companion changes (required, not optional -- CI would otherwise break)

• scripts/check_fixtures.py rewritten to key off records/ directly, not rules/pattern/ file contents
• scripts/check_rule_coverage.py removed (nothing left to check)
• scripts/generate-rules-and-fixtures.js removed (one-time generator for rule files that no longer belong in this repo)
• tests/test_fixtures.py rewritten: no local rule modules to load and run matches() against, so it now verifies fixture pairs exist, are non-empty, and match a real record -- the conformance-fixture model, not a detection-logic test
• .github/workflows/tests.yml: dropped the check_rule_coverage.py step and the --cov=rules coverage gate; pyproject.toml's [tool.coverage.run] source = ["rules"] removed
• .github/workflows/notify-ave-site.yml: dropped the rules/** path trigger. Also fixed while in this file: it still dispatched to bawbel/ave-site and referenced bawbel/ave in its own comments -- a live automation bug left over from the org move, not just a doc issue
• CLAUDE.md: hard rule 4, "Adding a record," and the Local commands block updated -- a record requires fixtures, not a local rule; rule authorship happens via a coordinated PR in the implementing tool's own repo (CONTRIBUTING.md Step 4 already said this; CLAUDE.md and add-ave-record/SKILL.md contradicted it until now)
• .claude/skills/add-ave-record/SKILL.md: step 4 no longer says "write the detection rule in rules/pattern/"; step 5 now points at the coordinated cross-repo PR
• .claude/skills/handoff/SKILL.md: the template example line referenced a rules/semgrep/ file this workflow no longer produces
• LANGUAGE.md: "Rule" definition no longer names rules/pattern/yara/semgrep as where rules live in this repo (a direct consequence of this deletion; LANGUAGE.md's other findings -- bawbel CLI names in its detection-layer table, stale record counts -- are tracked separately as Task D4, not folded in here)

Test plan

• python3 scripts/validate_records.py -- all 59 records still valid
• python3 scripts/check_fixtures.py -- all 59 records have positive/negative fixtures
• python3 -m pytest tests/ -x -q -- 236 passed
• Verified against a clean stash of the actual committed tree, not just the working directory
• Confirmed bawbel/scanner's own test suite (607 tests) passes independent of this repo