refactor(rules): drop the dead rule-mode validation seam

ruleModeCandidateRules / ruleModeValidation 零生产调用者——生产校验经由
RulesWorkflow 预检与 RuleRuntimeCompiler.compile；控制器内这份薄复制删除。
相关测试断言改为直接调用领域层 RuleRuntimeCompiler.validation（与被删缝
同参同义），遮蔽关系与重排不变性断言原样保留。

ShadowsocksX-NG2/App/ProxyRuntimeController+Mode.swift

@@ -147,19 +147,6 @@ extension ProxyRuntimeController {
     }
   }
 
-  func ruleModeCandidateRules() async throws -> [ProxyRule] {
-    try await ruleModeValidation().accepted
-  }
-
-  func ruleModeValidation() async throws -> CustomRuleValidationResult {
-    let document = try ruleDocuments.load()
-    let action = settings.ruleDefaultAction
-    let builtIn = try await runtimeBuiltinRules(action)
-    return await Task.detached(priority: .userInitiated) {
-      RuleRuntimeCompiler.validation(document: document, builtIn: builtIn, defaultAction: action)
-    }.value
-  }
-
   private func deployModeTransition(
     _ document: SslocalRuntimeDocument,
     snapshot: ModeTransitionSnapshot,

ShadowsocksX-NG2/Tests/CustomRuleControllerTests.swift

@@ -85,7 +85,10 @@ extension ProxyRuntimeControllerTests {
     let first = await controller.updateCustomRules(rules)
     XCTAssertEqual(first, .applied)
     XCTAssertEqual(try store.load(), rules, "保存保留用户 UUID 和全部意图")
-    let validation = try await controller.ruleModeValidation()
+    // 遮蔽关系由领域层验证器判定（与运行时部署无关的纯函数）。
+    let validation = RuleRuntimeCompiler.validation(
+      document: CustomRuleDocument(rules: rules, disabledIdentities: []),
+      builtIn: [], defaultAction: .directWhenUnmatched)
     XCTAssertTrue(
       validation.relationships.contains {
         $0.rule == rules[2].identity && $0.kind == .shadowing && $0.extent == .full
@@ -101,7 +104,9 @@ extension ProxyRuntimeControllerTests {
     XCTAssertEqual(try activeACLContent(runtimeStore), before)
     XCTAssertEqual(agent.unregisterCount, unregisterBefore)
     XCTAssertEqual(controller.readCustomRuleSummary(), summary)
-    let repeatedValidation = try await controller.ruleModeValidation()
+    let repeatedValidation = RuleRuntimeCompiler.validation(
+      document: CustomRuleDocument(rules: reversed, disabledIdentities: []),
+      builtIn: [], defaultAction: .directWhenUnmatched)
     XCTAssertEqual(repeatedValidation, validation)
   }
 

ShadowsocksX-NG2/Tests/CustomRuleMergeTests.swift

@@ -145,7 +145,7 @@ final class CustomRuleMergeTests: XCTestCase {
       custom(.direct, try RuleMatch(domainSuffix: "internal.example")),
       custom(.proxy, try RuleMatch(ipv4CIDR: "203.0.113.0/24")),
     ]
-    // 全局模式的 runtimeDocument 路径不调用 ruleModeCandidateRules；此处
+    // 全局模式的 runtimeDocument 路径不加载自定义规则集合；此处
     // 验证全局 ACL 文档本身不含自定义痕迹。
     let acl = ProxyACLDocument.global(
       at: URL(fileURLWithPath: "/tmp/ssxng-test/sslocal-active.acl"))