feat(rules): post-new hook driven by the rule store

Applies each enabled rule scoped to tag:new in stage order, then consumes
the marker. Two properties are deliberate and must survive any edit:

A rules file that will not load leaves tag:new alone and exits non-zero.
Clearing the marker while the rules did not run would permanently orphan
that mail, silently, and the gap would surface months later.

The marker is consumed only after every rule succeeded, so a failure part
way through leaves it set and a re-run finishes the work.

Removing `unread` or `inbox` is refused. maildir.synchronize_flags is
true, so removing `unread` rewrites Maildir filenames and reaches the
server on the next mbsync, and `inbox` is what keeps mail visible at all;
neither belongs in an unattended job. A rule that asks is skipped rather
than aborting the run, which would both cost the other rules their
tagging and strand tag:new forever. The restriction is expected to be
lifted once there is a way to confirm such a rule before it runs.

0 files changed, 0 insertions, 0 deletions