Function evaluate_rules 

pub fn evaluate_rules(rules: &[Rule], bag: &AttributeBag) -> Decision

Evaluate a phase’s rules against the bag.

Spec §3 semantics:

• First deny halts; subsequent rules / effects don’t run.
• allow effects do not short-circuit — evaluation continues to the next effect (then to the next rule).
• If no rule denies, the phase resolves to Decision::Allow.

Sync fast path — only handles control effects (Allow / Deny). Rules containing Plugin / Delegate / Taint effects must go through [evaluate_steps] instead, which has the async invoker traits wired up. This function silently skips non-control effects so a rule list mixed with Plugin still terminates cleanly on a later Deny — but the side effects don’t fire. Caller’s job to pick the right entry point for the effects in the rules.