[rennf93]

Closes #144

I am adding the engine side of the third reference-parity pass.

• guard_core_rs::live and Wiring::live: the stages a dynamic rule can change (country lists, cloud providers, blocked user agents, emergency mode, the penetration toggle, the rate limits and the ban knobs) are derived from Wiring::live_config and rebuilt when a rule changes one of the fifteen fields a rule may touch. The recorded rate-limit windows, the ban store, the violation counters and the cloud range table survive a rebuild (RateLimiter::with_config), and a rebuild the validators reject keeps the previous stages.
• Wiring::from_security_config_with calls SecurityConfig::validate first, as the reference does at construction (WiringError::Config); Wiring::build_unvalidated is the test seam. enable_redis without the redis feature keeps the documented per process fallback, because the reference default config also sets enable_redis and a redis_url.
• Shared constants for the strict-route answer (route_config) and the request-body read timeout (408).

Merge order: this PR first. The four adapter PRs build against it and show red until it merges.

Verification: fmt, clippy (-D warnings, stable 1.99, workspace, all features, guard-core-python), cargo test and the all-features run, the ledger, detection and pipeline conformance suites, docs with warnings denied, 100% line coverage and MSRV 1.92 check and test all pass locally.