Just for the sake of future reference, the issue ended up being pretty stupid: I forgot the doctype definition at the top of the rules file. Once I added that, it started picking up the rules.
I now have issues with the Coldbox security not picking up the logout, but it’s likely something related to the way the app is working.