Ship the OAI composition rules and reclassify unrestricted-shell rules

[jhumel-code]

Replaces #48, which also carried the compliance crosswalk. That crosswalk has
moved to the engine repo (see below), so this PR is rules only.

Brings the stale feat/severity-reclassification-acac work onto current main.
All of it existed only on that branch, so no user was receiving any of it.

What lands

Four rules that were tested but never shipped. OAI-025 (dead tool via
call-graph liveness), OAI-107 (handoff target wires shell tools), OAI-112 and
OAI-113 (transitive shell through handoff chains). OAI-112 and OAI-113 are the
only rules anywhere exercising reachability_is and
transitive_capability_exceeds_direct.

Severity reclassification. Six permission-bypass / unrestricted-shell rules
move from high to critical: CSDK-103, CSDK-120, CSDK-201, CSDK-202, ADK-008 and
LC-101.

Merge conflict resolution

One conflict, in ADK-008. main had corrected the title and widened the matcher
to cover both ExecuteBashTool (current google-adk) and BashTool (earlier
releases); the stale branch still had the BashTool-only matcher plus the
severity bump. Resolved by keeping main's corrected title, explanation and
wider matcher, and taking only the severity bump. Taking the branch wholesale
would have silently narrowed the rule so it stopped detecting current google-adk.

Why the compliance crosswalk is no longer here

It served no one in this repo. Compliance is a Guard-only surface: the
open-source scanner has no compliance package and no compliance command, so no
OSS user could consume the crosswalk, and Guard users never got it automatically
because the CLI defaults to a hardcoded pack. The engine's rule loader skips a
mappings/ subtree outright, so no scan ever read those files. The net effect
was editorial mapping work, with reviewer attribution, published in a public
repo while delivering nothing to anyone. It now lives embedded in the engine,
with a referential-integrity test that fails when a mapping names a rule no pack
defines. CLAUDE.md here records that this repo is not its home.

Verification

trustabl rules validate reports the same 12 errors on this branch as on clean
origin/main, so this introduces no new schema, duplicate-ID or
unknown-predicate errors. Those 12 are the known missing-predicate drift
(CSDK-017/018, CSDK-204, CSKILL-080..086), untouched here.

Known follow-ups, not addressed here

• OAI-025 cannot fire in a real scan. The engine runs its detector registry
  before it populates ToolDef.Reachability, and reachability_is returns false
  on an empty value. It ships inert until the engine ordering is fixed. Its unit
  test passes only because it hand-sets the field on a synthetic tool.
• OAI-107 and OAI-112's fix text is self-defeating. It recommends adding an
  input_filter, but that can only be attached via the handoff(...) helper,
  which discovery marks External, which empties the transitive closure and
  silences all three composition rules.
• The paired rulebook still carries severity: high for the six reclassified
  rules, and has no rationale doc for the four new ones.