feat(ttp): E.3.5 FilesystemRuleStore — inotify hot-reload + per-rule events

Implements the filesystem-backed rule store body left empty at contract
phase: YAML parse + Pydantic validation, asyncinotify watch over
./rules/ttp/, in-process state cache with auto-revert on expires_at,
and a subscribe_changes() async iterator yielding one RuleChange per
per-rule edit. Bus topic builders ttp_rule_reloaded / ttp_rule_state
ship alongside.

Why: the rule plane needed a store before the engine (E.3.7) could
consume RuleChange events and atomically swap compiled rules into its
dispatch index.

Notes:
- Linux-only by construction (asyncinotify wheel gated by sys_platform
  marker; FilesystemRuleStore.__init__ raises on non-Linux).
- Filename allowlist is the FIRST check on every inotify event.
- Content-hash dedup so a single write firing IN_CREATE + IN_CLOSE_WRITE
  produces exactly one RuleChange.
- All compile work serializes on a single asyncio.Lock.
- Subscribers register their queue eagerly so events fired between
  subscribe_changes() and the first __anext__() are buffered.

xfails flipped: per-save-style + filter-ordering + atomic-swap in
test_filesystem.py; load_compiled / set_state isolation / round-trip /
per-rule fan-out / expired-state revert / set_state failure semantics
in test_conformance.py (FS side; DB side stays xfail until E.3.6);
malformed-YAML compile-time check in test_rule_engine.py.

Tests: 197 passed, 35 xfailed (gated on E.3.6 / E.3.7 / lifters).
mypy + bandit: clean on all touched files.

Wiki update for the per-rule reload + state-change topics lands in a
matching wiki-checkout/Service-Bus.md edit (separate repo).

decnet/bus/topics.py

@@ -278,12 +278,15 @@ EMAIL_RECEIVED = "received"
 #                                    or the rule's RuleState was disabled).
 #                                    Observability signal for the dashboard.
 #
-# Per-rule reload + state-change topics (``ttp.rule.reloaded.{rule_id}`` /
-# ``ttp.rule.state.{rule_id}``) ship in the RuleStore contract step — they
-# are co-located with the producer.
+# Per-rule reload + state-change topics. Built via
+# :func:`ttp_rule_reloaded` / :func:`ttp_rule_state`; SIEM consumers
+# subscribe to ``ttp.rule.reloaded.>`` (every rule) or
+# ``ttp.rule.reloaded.R0001`` (one rule) at their preferred granularity.
 TTP_TAGGED = "tagged"
 TTP_RULE_FIRED = "rule.fired"
 TTP_RULE_SUPPRESSED = "rule.suppressed"
+TTP_RULE_RELOADED = "rule.reloaded"
+TTP_RULE_STATE = "rule.state"
 
 
 # ─── Builders ────────────────────────────────────────────────────────────────
@@ -485,6 +488,36 @@ def ttp_rule_fired(technique_id: str) -> str:
     return f"{TTP}.rule.fired.{technique_id}"
 
 
+def ttp_rule_reloaded(rule_id: str) -> str:
+    """Build ``ttp.rule.reloaded.<rule_id>``.
+
+    Per-rule fan-out fired by the :class:`~decnet.ttp.store.base.RuleStore`
+    when a rule's *definition* changes (YAML edit on the filesystem
+    backend, ``ttp_rule`` row update on the database backend). One event
+    per per-rule edit — never batched (the "incremental, never batched"
+    property in TTP_TAGGING.md §"Bus topics" inherits its granularity
+    from :meth:`RuleStore.subscribe_changes`).
+
+    Subscribers: ``ttp.rule.reloaded.>`` for every rule,
+    ``ttp.rule.reloaded.R0001`` for one. *rule_id* is validated as a
+    single segment.
+    """
+    _reject_tokens(rule_id)
+    return f"{TTP}.{TTP_RULE_RELOADED}.{rule_id}"
+
+
+def ttp_rule_state(rule_id: str) -> str:
+    """Build ``ttp.rule.state.<rule_id>``.
+
+    Per-rule fan-out fired by the :class:`~decnet.ttp.store.base.RuleStore`
+    when a rule's *operational state* changes (operator hits the disable
+    button, an ``expires_at`` TTL fires and auto-reverts the state).
+    *rule_id* is validated as a single segment.
+    """
+    _reject_tokens(rule_id)
+    return f"{TTP}.{TTP_RULE_STATE}.{rule_id}"
+
+
 def _reject_tokens(*parts: str) -> None:
     """Reject topic segments that would break NATS-style tokenization.