feat: draft negative location exclusions

[thiagoc7]

Adds draft support/workflow for negative location exclusions.

[kLOsk]

Thanks, this fills a real gap (#46 tracks it). To land it: (1) rebase onto v0.10.0 (current_config() instead of _config); (2) use entity_type="campaign_criterion" for consistency with the existing rules docs; (3) dedupe against existing exclusions, main already has _existing_negative_geo_exclusions() you can reuse; (4) tests plus a rules-file entry (see PR #38 for the standard). Note that PR #34 contains an overlapping implementation; this one is the better base, so it gets to be the canonical version.

[kLOsk]

Merged to main — thank you @thiagoc7! 🙏 Clean implementation that slotted straight into the current codebase despite two months of drift (multi-tenant safety refactor landed in between). I added tests for the preview/apply paths and documented the tool in the README + orchestration rules on top of your commit. add_negative_locations ships as the 47th tool in the next release.