Runtime injection of Cursor auto-attached rules triggered by a file path that the model has read or written.

This is the moving part that mirrors Cursor's own "auto-attach" semantics: when a file is added to the chat context, any rule whose globs match that file should be in context too. In fnord we interpret "added to context" as "read by file_contents_tool" or "written by file_edit_tool".

Each rule-path pair fires at most once per session (gated via Services.Once). Injected messages are system-role and are stripped from the persisted conversation, just like the other coordinator scaffolding.