[HexCodeYT]

Summary

Adds the first trust layer around generated external rules:

• extends plainlink-rules import-clearurls with --manifest and --source-revision
• records deterministic input/output SHA-256 hashes, import counts, and skip-reason stats
• adds plainlink-rules verify-fixtures to run the existing .plainlink-case corpus against native rules plus optional generated rule files or directories
• updates contributor docs and Mermaid diagrams for the rule-source safety gate

Why

PlainLink should be able to use community-maintained privacy lists without blindly shipping generated output. This makes imported rules reproducible, auditable, and regression-tested before they become part of a release.

Validation

• cargo fmt --check
• cargo test
• cargo clippy --all-targets -- -D warnings
• cargo run --bin plainlink-rules -- import-clearurls --input tests/fixtures/clearurls-sample.json --output /private/tmp/plainlink-clearurls-sample.plainlink --manifest /private/tmp/plainlink-clearurls-sample.manifest --source-name "ClearURLs Test Fixture" --source-url https://example.test/clearurls.json --source-revision test-revision --license test-only
• cargo run --bin plainlink-rules -- verify-fixtures --rules /private/tmp/plainlink-clearurls-sample.plainlink
• scripts/package-macos-app.sh