Add timeout, busy-state, parser-variant and build-freshness rules

- task-discipline: require explicit target platform/language before implementation
- go-api: bounded context deadline on every outbound network/DB call
- controls-selection: visible busy state for any control triggering such a call
- import-export: enumerate real format variants before writing a parser
- app-binary: embedded assets do not hot-reload; verify rebuild before diagnosing

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rules/patterns/app-binary/contract.md

@@ -1,6 +1,6 @@
 # Contract: Application Binary
 
-Version: 1.0
+Version: 1.1
 
 ## Purpose
 
@@ -21,4 +21,7 @@ See `README.md` for deployment examples and a sample config template.
 - For local SQLite mode, the database file lives next to the config and its path is derived by the application, not configured separately.
 - On first run with no config, the application must create the config, print its path, exit 0, and stop. It must not continue startup with a fresh placeholder config.
 - The binary must not depend on the caller's working directory.
+- Assets bundled at compile time (`//go:embed` and equivalents) do not hot-reload. Before diagnosing
+  a bug reported against a generated or served artifact, confirm the running process was rebuilt and
+  restarted after the last change; use the displayed build version (`build-version-display`) to check.
 - Build with `CGO_ENABLED=0` when possible. Enable CGO only when the chosen storage/runtime actually requires it, such as SQLite drivers that need CGO.