Add Periscope Cursor engineering constitution and always-on rules.

Docs-only: master CODING_CONSTITUTION plus seven .mdc splits. Git policy is
phase = test then commit+push; deploy only after a macro-phase.

.cursor/rules/20-python.mdc

@@ -0,0 +1,18 @@
+---
+alwaysApply: true
+---
+
+# Periscope Cursor Engineering Rules
+
+Mandatory for every Cursor agent working on Periscope. This section is copied from `docs/development/CODING_CONSTITUTION.md` and must not contradict that master.
+
+## 2. Python
+
+- Python 3.12+, Pydantic 2.x, FastAPI on the backend.
+- Parsers and graph builders are pure functions without hidden I/O, except documented loaders (`build_graph` from paths).
+- All shared data structures are Pydantic models in `backend/periscopex/models.py` (or the native successor once rewritten).
+- Tests live under `tests/` against `simple_project/` as ground truth. Emmaforo behavior is a live spec, not a license to skip unit tests.
+- Extraction prompts live in `skills/` and run in-process. Bump `default_model_version` in `skills_manifest.json` when skill prompts change; never call Anthropic Console.
+- Use stdlib hashing (`hashlib.scrypt` in `local_users.hash_password`) for local passwords. Do not invent a homemade hash.
+- `repo_paths.py` locates taxonomy, skills, vendor, changelog. Do not hard-code `/app` without the Docker heuristic that also requires `vendor/`.
+- Format and lint with the repo’s existing tools. Do not drive-by reformat unrelated files.