RULES: readonly RuleDescriptor[] = ...

The full rule table. Order is significant: rules fire in this order, and the report's findings are stable per-file in this order. Every entry must have a corresponding detect* function in scan.ts; scan.ts looks up rules by ID.