[v2] Create StateInvariant Rules Engine

[SHAURYASANYAL3]

Phase 2: State Lattice

The Context

Once the ShadowFilesystem generates a MutationResult, we need a Rules Engine to enforce boundaries on that result. If the simulated mutation violates an invariant, the action is blocked before it ever executes.

Tasks

• Create a StateInvariant struct/class containing a name, a severity level, and a lambda/function for the check logic.
• Implement a StateChecker engine that loops through registered invariants and evaluates the MutationResult.
• Implement a default set of invariants:
  • critical_paths_immutable: Rejects mutations affecting /etc, /var, ~/.ssh, etc.
  • max_file_deletion: Limits how many files can be deleted in a single action block.
• Ensure violations result in a clear, deterministic block without relying on an LLM.

Part of Epic #651