Let module callers pass in-memory mapping rules to Set

[marcleblanc2]

Completes dev/PLAN.md Track A Phase A4 (the one piece deferred from #31).

What

src.Set(config, mapping_rules=[...]) runs permission sync from parsed rules with no maps YAML file. Combined with GetResult data and no_files=True, the full get -> assemble -> dry-run loop never touches disk.

Guarantees

• In-memory rules pass through the same structural validation as file-loaded rules, at the edge, before any network or path resolution
• With files enabled, the rules actually used are serialized into the run directory as the maps.yaml audit copy - a stale customer maps file is never copied
• Reversibility invariant unchanged: snapshots still gate apply; no_files + apply keeps requiring no_backup
• Module-mode diagnostics: swallowed SystemExit messages now surface through the package logger so host applications can see why a run failed
• MappingRule exported for caller typing

Tests

• Rules resolution/validation matrix (file fallback, decoy-file ignored, no file needed, empty rules, invalid structures rejected)
• Audit serializer round-trip through the standard loader
• e2e parity: file vs in-memory vs in-memory+no_files produce identical mutations and end state on both dry-run and apply fixture cases; audit copy content equals the rules used; invalid rules fail fast with zero mutations
• Module-API: falsy results without exceptions, diagnostic on the package logger, no maps file needed (proven via HTTP-attempt counters on the run-end event)

Verification

• uv run tests/run.py - 102/102
• uv run tests/run.py --live - 120/120 against the sgdev test instance
• pyright strict 0 errors, ruff + markdownlint clean