fix: embed detector rules for standalone binaries

[pixincreate]

Summary

• fall back to detector rules compiled into the binary when no external detectors.toml is available
• preserve external detector precedence and explicit configuration errors
• add standalone/runtime-error regressions and document the CLI, scan pipeline, and detector trust boundaries with reproducible D2 diagrams

Verification

• cargo fmt --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-features (147 passed)
• cargo test --release --all-features (147 passed)
• D2_BIN=<d2-v0.7.1> ./scripts/render-diagrams.sh check
• cargo package
• Rust LSP diagnostics: clean