Where should I put local-system-specific rules or configuration options?
Local configurations should go in the site-specific area - typically /etc/mail/spamassassin.
Do not put them in /usr/share/spamassassin (where the rules distributed with SpamAssassin are stored) - this directory is cleaned out when new versions of SpamAssassin are installed. Type "man Mail::SpamAssassin::Conf" for details of what you can configure, and how to do it.