feat(ttp): E.3.18c wire RuleEngine via RuleEngineTagger

The canonical rule-based engine from §"Tagging engines, layered §1"
of TTP_TAGGING.md was fully implemented but never instantiated as a
composite child — pure pattern rules (R0014/R0017/R0023/... 23 rules
total) had no tagger to dispatch them.

- Add `RuleEngineTagger(Tagger)` adapter in rule_engine.py wrapping
  `RuleEngine.evaluate()`. `HANDLES = {command, http_request,
  auth_attempt, payload}` — the source kinds whose rules typically
  live outside any per-source lifter.
- Adapter's `watch_store()` filters via `_is_engine_owned` so the
  engine's dispatch index excludes lifter-claimed rules
  (`match.kind: lifter:*`) and stays disjoint from per-lifter ownership.
- Prepend `RuleEngineTagger` to the `CompositeTagger` lifter list so
  generic pattern rules dispatch before per-source cross-event logic.
- Composes with E.3.18a (worker hydrates `watch_store`) and E.3.18b
  (worker fans session payloads into per-`command` events) — together
  these three commits make R0001–R0030 actually fire at runtime.

decnet/ttp/factory.py

@@ -142,9 +142,16 @@ def get_tagger() -> Tagger:
         from decnet.ttp.impl.email_lifter import EmailLifter
         from decnet.ttp.impl.identity_lifter import IdentityLifter
         from decnet.ttp.impl.intel_lifter import IntelLifter
+        from decnet.ttp.impl.rule_engine import RuleEngineTagger
         from decnet.ttp.store.factory import get_rule_store
         store = get_rule_store()
+        # RuleEngineTagger first so generic pattern rules dispatch
+        # before the per-source lifters' cross-event logic. Order is
+        # observational — every tagger sees every event for its
+        # `HANDLES` set; tags from all of them aggregate into a single
+        # `ttp.tagged` envelope at the worker.
         return CompositeTagger(lifters=[
+            RuleEngineTagger(store),
             BehavioralLifter(store),
             IntelLifter(store),
             CanaryFingerprintLifter(store),