feat(rules): add safe atomic rules pack updates

[Karib0u]

Purpose

Add lifecycle support for safely updating the active cumulative rules pack after initial installation.

Scope

• Add rustinel rules update.
• Read the active pack from state.json.
• Check the catalog for a newer compatible version.
• Download and validate through the same safe installation pipeline used by rules install.
• Atomically activate the update.
• Preserve rollback capability on failure.
• Decide whether a service restart is required or hot reload is sufficient.

Acceptance Criteria

• No-op output when the active pack is current.
• Only compatible updates are installed.
• Checksum and safe extraction are mandatory.
• Failed updates preserve the previous pack.
• Hot reload or restart behavior is documented and tested.

Dependencies

• feat(rules): list and install rustinel-rules packs #107

Priority

P1