Custom rules
Custom rules use defineRule and receive frozen normalized facts only. A rule
may be async. It reports findings through context.report and cannot mutate
facts. Facts come from public MF options, manifests, stats, and recorded
capabilities, not private plugin state
(limitations).
Register custom rules through extends (alone or inside a
policy pack):