Policy: system-folder deletes TK-D014 doesn't read yet (find in parentheses, -exec, WSL and Cygwin mounts, chgrp, chattr) #810

TK-D014 denies a recursive delete or permission change of a system folder (rm -r /etc, chmod -R of /usr, …). Its row in docs/limits.md (L282) lists what it doesn't read. Each item below is a self-contained change to the rule in tracekit/policy2/packs/coding.yaml (L99); one PR per item is fine, and several people can take different items.

Not denied yet (checked at current main on the coding and strict packs)

1. find with its filters in parentheses: find /etc \( -type f -o -type d \) -delete is allowed. Read a parenthesised group of filters that match every file as the rule reads them without parentheses.
2. find that changes what it finds through -exec: find /etc -exec rm {} + (no -r) and find /etc -exec chmod -R 777 {} + are only flagged (TK-F003).
3. xargs fed by a here-string: xargs rm -rf <<< /etc is only flagged.
4. Windows through WSL's or Cygwin's mount: rm -rf /mnt/c/Windows and rm -rf /cygdrive/c/Windows are only flagged, while C:\Windows, C:/Windows and /c/Windows are denied.
5. A subfolder, then ..: rm -rf /etc/ssh/.. is only flagged, while one <folder>/../ step before the name (/usr/../etc) is denied.

Commands the rule doesn't name

6. chgrp -R staff /etc and chattr -R +i /etc are allowed; mv /etc /tmp/etc.bak is flagged; rsync -a --delete empty/ /etc/ is flagged on the coding pack (strict asks). Decide per command whether it belongs in TK-D014 (deny) or in an ask rule, and say why in the rule's comment.

Done when (for any item)

• test_deleting_or_locking_a_system_folder_is_denied in tests/test_signer_policy.py (L3485) gets the new calls, and its not_in_every_pack list a benign twin each (a project folder such as ./etc, /var/tmp/x or /usr/local/x), on every pack and both engines.
• Nothing gets looser: decide tests/data/policy and the E21 corpora before and after.
• The pattern stays linear: test_adversarial_calls_decide_before_the_fallback_deadline in tests/test_policy2.py and the TK-D014 speed test there (L997) pass.
• The coding pack's version (coding.yaml L14) is bumped, the evals re-recorded (python eval/e17_policy_corpus.py, python eval/e21_policy_robustness.py, python eval/e21_robustness.py), and the limits row updated to match.

Commits need a DCO sign-off (git commit -s).