[rennf93]

Closes #95

Ports Guard-Core/guard-core#169 to the Go engine. applyRulesLocked now takes the previous state as the rollback target, restores the retained base snapshot before applying, and then snapshots again, so each version (or a different rule id) is an overlay on the base config and not on the previous version. A failed apply restores the previous state and the base stays the true base. Expiry is unchanged. Emergency mode no longer compounds: base 16 gives 8, 8, 8 across versions 1 to 3, and expiry restores 16.

Other divergences fixed in the same area: suspicious_patterns already held by the registry (shipped table or earlier additions) are skipped as in the reference, and the global rate limit log line printed the pointer address of GlobalRateLimit. I left user-agent validation on regexp.Compile (RE2, linear time) since the reference ReDoS validator guards a backtracking engine.

I ported the eight reference tests with the same scenarios and values. On master six of them fail (halving gives 8, 4, 2; a version keeps the previous version's change; a different rule id inherits it; expiry restores 4 instead of 16; a version after boot hydration compounds to 4; a pattern is registered three times), and the collection and failed-apply tests pass on both sides. applyFault is a test seam so the fail-closed path can be driven. The two writeAtomicFile waivers move from lines 733/738 to 767/772 with identical code.