dir_only_contains

Every direct-child file of a directory matching select: must match at least one glob in allow:. Catches stray test data in src/.

- id: src-only-rs
  kind: dir_only_contains
  select: "src/*"
  allow: ["*.rs", "README.md"]
  level: error