feat(rules): :nodejs_detected — add /bindings/rescript/ carve-out (post #275 closeout cleanup)

[hyperpolymath]

Summary

Surfaced during the hyperpolymath/standards#275 STEP 7 closeout estate-wide hypatia scan: proven-servers/bindings/rescript/package-lock.json was the single uncarved hit across 20 estate-wide package-lock.json files.

The rescript variant is host-required for the rescript-to-js compile chain (same pattern as JS/TS consumer exports, just produced from .res sources) and is symmetric to the existing /bindings/javascript/ and /bindings/typescript/ carve-out class (5c).

Changes

lib/rules/cicd_rules.ex — carve-out class 5c extended:

Before	After
/bindings/javascript/	/bindings/javascript/
/bindings/typescript/	/bindings/typescript/
—	/bindings/rescript/

Comment block updated to reflect the rescript variant + reference the standards#275 STEP 7 surfacing context.

test/rules/cicd_rules_rescript_npm_js_test.exs — 1 new test case in the nodejs_detected rule describe block asserting that lockfiles under any of the three sibling consumer-export bindings paths are exempt.

Why this closes the loop

The standards#253 closeout PR (hyperpolymath/standards#325) merged 2026-05-31T07:11Z, declaring the npm → Deno migration "substantially complete" with "zero :nodejs_detected flags outside carve-outs". The estate-wide scan during that closeout's STEP 7 audit (hyperpolymath/standards#275) surfaced one uncarved hit. This PR makes the closeout declaration exactly true (was 19/20 prior).

Test plan

• CI: existing nodejs_detected suite passes
• New test: exempts */bindings/{javascript,typescript,rescript}/ consumer exports passes (already syntactically validated via Code.string_to_quoted!)
• Hypatia self-scan: no false-positive flagging on proven-servers/bindings/rescript/

Refs hyperpolymath/standards#253 (umbrella, CLOSED 2026-05-31)
Refs hyperpolymath/standards#275 (STEP 7, CLOSED 2026-05-31)
Refs #405 (predecessor — first batch of class-5c carve-outs added vscode-, tree-sitter-, Lake, Office, javascript/typescript bindings)

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 103 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	103

View findings

[
  {
    "reason": "Action urin 21 JRE\n        uses: actions/setup-java@be666c2fcd27 needs attention",
    "type": "unpinned_action",
    "file": "verify-proofs.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in clusterfuzzlite.yml",
    "type": "missing_timeout_minutes",
    "file": "clusterfuzzlite.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence