Merge origin/main @ 274f378faf — credential-material rules, re-expressed rule-scoped