feat(core-eslint): add no-undeclared-rate-limit conformance rule

Adds the `no-undeclared-rate-limit` ESLint rule (warn severity) that
enforces rate-limit drift at lint time:

- Warns when rateLimit.consume("X", _) is called inside a use-case but
  "X" is absent from manifest.useCases[name].rateLimit
- Warns when a declared rateLimit budget has no matching consume call
  in the use-case body (unusedDeclaration)
- Is a no-op outside use-case files

Extends _manifest-ast.js to extract the rateLimit[] field from both
parseManifestUseCases and parseManifestFully. Updates _manifest-ast
tests to include the new field in expected shapes. Registers the rule
at warn severity in plugin.js and base.js. Adds RuleTester fixtures
for all four cases (declared+matching, undeclared, unused, non-use-case).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/core-eslint/rules/no-undeclared-rate-limit.test.js

@@ -0,0 +1,143 @@
+import { describe, it } from "vitest";
+import { RuleTester } from "eslint";
+import path from "node:path";
+import os from "node:os";
+import fs from "node:fs";
+import rule from "./no-undeclared-rate-limit.js";
+
+function makeFixture({ manifestRateLimit, useCaseBody }) {
+  const repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), "nurl-"));
+  const featureDir = path.join(repoRoot, "packages", "demo");
+  fs.mkdirSync(path.join(featureDir, "src", "application", "use-cases"), {
+    recursive: true,
+  });
+  const rateLimitField =
+    manifestRateLimit.length > 0
+      ? `, rateLimit: [${manifestRateLimit.map((b) => `"${b}"`).join(", ")}]`
+      : "";
+  fs.writeFileSync(
+    path.join(featureDir, "src", "feature.manifest.ts"),
+    `export const demoManifest = defineFeature({
+  name: "demo",
+  requiredCores: [],
+  useCases: {
+    signUp: { mutates: true, audits: [], publishes: [], consumes: []${rateLimitField} },
+  },
+  realtimeChannels: [],
+  jobs: [],
+} as const);`,
+  );
+  const useCaseFile = path.join(
+    featureDir,
+    "src",
+    "application",
+    "use-cases",
+    "sign-up.use-case.ts",
+  );
+  fs.writeFileSync(useCaseFile, useCaseBody);
+  return { repoRoot, useCaseFile };
+}
+
+const tester = new RuleTester({
+  languageOptions: {
+    parser: await import("@typescript-eslint/parser"),
+    ecmaVersion: "latest",
+    sourceType: "module",
+  },
+});
+
+describe("no-undeclared-rate-limit", () => {
+  it("passes when rateLimit.consume budget matches manifest rateLimit[]", () => {
+    const { repoRoot, useCaseFile } = makeFixture({
+      manifestRateLimit: ["signUp.ip"],
+      useCaseBody: `export const signUpUseCase = (rateLimit) => async (input) => { await rateLimit.consume("signUp.ip", input.ip); };`,
+    });
+    tester.run("no-undeclared-rate-limit", rule, {
+      valid: [
+        {
+          filename: useCaseFile,
+          code: fs.readFileSync(useCaseFile, "utf8"),
+          options: [{ repoRoot }],
+        },
+      ],
+      invalid: [],
+    });
+  });
+
+  it("fires when rateLimit.consume budget is not declared in manifest", () => {
+    const { repoRoot, useCaseFile } = makeFixture({
+      manifestRateLimit: [],
+      useCaseBody: `export const signUpUseCase = (rateLimit) => async (input) => { await rateLimit.consume("signUp.ip", input.ip); };`,
+    });
+    tester.run("no-undeclared-rate-limit", rule, {
+      valid: [],
+      invalid: [
+        {
+          filename: useCaseFile,
+          code: fs.readFileSync(useCaseFile, "utf8"),
+          options: [{ repoRoot }],
+          errors: [
+            {
+              messageId: "undeclared",
+              data: { budget: "signUp.ip", useCase: "signUp" },
+            },
+          ],
+        },
+      ],
+    });
+  });
+
+  it("fires when a declared budget is never consumed in the use-case body", () => {
+    const { repoRoot, useCaseFile } = makeFixture({
+      manifestRateLimit: ["signUp.ip"],
+      useCaseBody: `export const signUpUseCase = () => async () => { return { ok: true }; };`,
+    });
+    tester.run("no-undeclared-rate-limit", rule, {
+      valid: [],
+      invalid: [
+        {
+          filename: useCaseFile,
+          code: fs.readFileSync(useCaseFile, "utf8"),
+          options: [{ repoRoot }],
+          errors: [
+            {
+              messageId: "unusedDeclaration",
+              data: { budget: "signUp.ip", useCase: "signUp" },
+            },
+          ],
+        },
+      ],
+    });
+  });
+
+  it("is a no-op for non-use-case files", () => {
+    const { repoRoot } = makeFixture({
+      manifestRateLimit: ["signUp.ip"],
+      useCaseBody: `export const signUpUseCase = (rateLimit) => async (input) => { await rateLimit.consume("signUp.ip", input.ip); };`,
+    });
+    const serviceFile = path.join(
+      repoRoot,
+      "packages",
+      "demo",
+      "src",
+      "application",
+      "services",
+      "sign-up.service.ts",
+    );
+    fs.mkdirSync(path.dirname(serviceFile), { recursive: true });
+    fs.writeFileSync(
+      serviceFile,
+      `export function doWork(rateLimit) { rateLimit.consume("undeclared", "x"); }`,
+    );
+    tester.run("no-undeclared-rate-limit", rule, {
+      valid: [
+        {
+          filename: serviceFile,
+          code: fs.readFileSync(serviceFile, "utf8"),
+          options: [{ repoRoot }],
+        },
+      ],
+      invalid: [],
+    });
+  });
+});