fix(config): a rules_engine section without enabled: true silently disables the built-in rules #638

Found while verifying #636. With no rules_engine section in .cora.yaml the built-in rule engine runs (e.g. sec-hardcoded-secret flags password = "abc" + "defgh12345"). Adding a section such as

rules_engine:
  max_findings: 0

(the documented way to raise the cap from #624) makes the engine skip all built-in rules, because RulesSection.enabled is a plain bool whose serde default is false, and apply copies it over the default (config.rules_config.enabled = re.enabled, src/config/schema.rs ~L794; consumer src/engine/rules/mod.rs ~L27). Result: tuning one knob silently removes detections (only the scanners remain).

Direction: default enabled to true when the section is present (#[serde(default = "default_true")]) or make it Option<bool>; add a test that a section with only max_findings keeps rules on; document enabled: false as the way to turn the engine off.