Optimize rule injection caches

[code-yeongyu]

Summary

• Cache compiled glob matchers for rule matching.
• Dedupe dynamic rule loading work.
• Preserve nested dynamic project roots.
• Bound matcher and dynamic match caches.

Improvement table

Area	Baseline before this PR	Final pinned behavior	Delta / proof
Repeated glob matching	Repeated calls could recompile the same glob set.	20 repeated matches keep entries: 1, compiledPatterns: 2.	Compile work reduced to one cached pattern set; pinned in test/matcher.test.ts.
Duplicate dynamic targets	Three duplicate targets could repeat project-root, discovery, and rule-read work per target.	findProjectRoot: 1, findCandidates: 1, readFile: 1 for three duplicate targets.	Deterministic work counters reduced from per-target repetition to one pass; pinned in test/engine.test.ts.
Repeated unchanged match decisions	Same target/rule body could re-run matching on repeated dynamic calls.	matchRuleCalls remains 1 across two calls.	Repeated unchanged decision avoids the second match pass; pinned in test/engine.test.ts.
Cache resource bound	Matcher cache size was not pinned by test.	Matcher cache stays <= 256 entries.	Memory growth bounded; pinned in test/matcher.test.ts.

Verification

• npm test
• npm run check
• npm pack --dry-run
• no-excuse TypeScript gate

Review

• Security, QA, context, and goal-verifier lanes completed locally.
• Cubic review passed before merge.

[cubic-dev-ai]

No issues found across 5 files

_{Re-trigger cubic}