feat(ignore): path-scoped ignore.rules (silence a rule in some directories only) #680

Problem

ignore.rules applies to the whole project and ignore.files removes a file from every check. There is no way to say "rule X is noise under crates/cli/** but must stay on in crates/core/**". Today the only options are: silence the rule everywhere, exclude the directory from all checks, or sprinkle inline markers.

Real case

A Rust workspace with a CLI crate and an embedder-safe core crate. bug-println is noise in the CLI (stdout is its interface; 64 hits) but guards a real design rule in the core ("never write to stdout"). With only global switches the choice was: keep 64 false positives, or silence the rule everywhere and re-implement the core-only half as a rules_engine.custom rule with an exclude list (which works, but is a workaround and duplicates what the built-in rule already knows).

Proposal

Allow ignore.rules entries to be objects, backwards compatible with plain strings:

ignore:
  rules:
    - "Hardcoded password or secret"          # unchanged: whole project
    - rule: bug-println
      files: ["crates/cli/**", "evals/**"]    # only these paths
    - rule: bug-expect
      files: ["**/subprocess.rs"]
      reason: "expects state a local invariant"   # shown in reports, optional

• files uses the same glob syntax as ignore.files.
• Optional reason surfaces in JSON/SARIF suppression metadata (pairs well with a reason separator for inline markers).
• Works in review, scan and the MCP tools, applied before the max_findings cap like today.

Alternatives considered

• Per-directory .cora.yaml overrides (heavier; monorepo-oriented).
• Inline markers (precise, but 60+ sites for a rule that is intentionally project-style).

Done when

A rule can be silenced for one subtree while still firing in another, with tests for glob matching and for the unchanged string form.