Problem : Rule loader should reject unsupported logic edge cases

Nobody has claimed this yet.

## Problem

While experimenting with capa rule logic, I noticed that some rule constructs are currently accepted during rule loading even though they are not safe for the optimized matcher/indexer.

In particular, certain logical edge cases can lead to ambiguous or incorrect evaluation behavior.

Examples include:

- top-level `not` statements
- nested `not` constructs (e.g. `not: not: ...`)
- top-level `count(...): 0` statements

These patterns may conflict with assumptions made by the optimized rule matcher and rule indexer.

## Example

For example, a rule containing something like:

```yaml
not:

api: CreateFileA
Or
not:
not:
api: CreateFileA
Similarly, constructs like:
count(api(CreateFileA)): 0
may introduce ambiguity or unexpected behavior during rule evaluation.

Expected Behavior

Rules containing unsupported logic constructs should be rejected during rule loading with a clear validation error.

This would:
• prevent subtle evaluation bugs
• ensure rules remain compatible with the optimized matcher/indexer
• provide clearer feedback to rule authors when invalid constructs are used.

Related Work #2913

Start by reading the rule-loading validation path and the optimized matcher/indexer assumptions, then compare the related work in #2913. Verify how top-level or nested not constructs and count(...): 0 are currently accepted. Done means unsupported constructs are rejected during loading with clear validation errors and existing rule behavior remains covered.

Written by the indexing model from the issue text.