Add timeout, busy-state, parser-variant and build-freshness rules

- task-discipline: require explicit target platform/language before implementation
- go-api: bounded context deadline on every outbound network/DB call
- controls-selection: visible busy state for any control triggering such a call
- import-export: enumerate real format variants before writing a parser
- app-binary: embedded assets do not hot-reload; verify rebuild before diagnosing

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rules/patterns/controls-selection/contract.md

@@ -1,6 +1,6 @@
 # Contract: Controls + Selection
 
-Version: 1.2
+Version: 1.3
 
 ## Shared Base
 
@@ -16,6 +16,11 @@ Version: 1.2
 - Button text should describe the action outcome, not implementation detail.
 - Buttons are text-first; icons are optional and must not replace labels on primary/danger actions.
 - Base examples must show both `disabled` and `loading` states.
+- Any control that triggers a network or database call must show a visible busy state for the whole
+  duration of that call (spinner on the control, disabled control, or an equivalent indicator), and
+  must not be re-triggerable while busy. Without it, "slow" is indistinguishable from "broken".
+- This applies to every call, not only to long-running background tasks. The server-side half of the
+  rule — a bounded timeout on the call itself — is owned by `go-api`.
 - Do not use a hyperlink (`<a>`/link-styled text) to open a modal, drawer, detail view, or any
   other in-page element. Use a `button` (or button-styled control) instead, unless the user
   explicitly asks for a hyperlink. Hyperlinks are reserved for navigation to another URL/page.