chore(sync): cascade fleet template@ae5e5c7

Auto-applied by socket-wheelhouse sync-scaffolding into vscode-socket-security.
2 file(s) touched:
  - .config/oxlint-plugin/lib/fleet-paths.mts
  - .config/oxlint-plugin/rules/no-file-scope-oxlint-disable.mts

Author: jdalton

.config/oxlint-plugin/lib/fleet-paths.mts

@@ -0,0 +1,51 @@
+/**
+ * @file Shared path-suffix constants for fleet-canonical files that any
+ *   plugin rule may need to recognize. Centralizing these out of individual
+ *   rule files lets multiple rules share the same opt-in / opt-out list
+ *   without duplicating the path string + its rationale comment.
+ *
+ *   Examples of consumers:
+ *
+ *   - `no-file-scope-oxlint-disable` exempts `scripts/paths.mts` (deliberate
+ *     flow-ordered exports, see PATHS_FILE constant below).
+ *   - `socket/prefer-cached-for-loop` and `socket/no-cached-for-on-iterable`
+ *     share `lib/iterable-kind.mts` for the binding-kind heuristic — sibling
+ *     pattern.
+ *
+ *   When a new rule needs to recognize one of these path patterns, add the
+ *   import here and use the constant, not a re-spelled literal.
+ */
+
+/**
+ * The fleet's "1 path, 1 reference" source-of-truth file. Each fleet repo has
+ * one. Its exports are ordered by path-resolution flow (REPO_ROOT → primary
+ * roots → build paths → helpers) — deliberately not alphabetical, and the
+ * order is load-bearing for code review. Anything keyed on per-file behavior
+ * that recognizes `paths.mts` should match by suffix.
+ */
+export const PATHS_FILE = 'scripts/paths.mts'
+
+/**
+ * Plugin-internal rule + test directories. Rule files often contain the
+ * banned shape they ban as lookup-table data (e.g. `no-status-emoji.mts`
+ * literally contains the emoji it bans). Same for the matching test files,
+ * which intentionally exercise the banned shape.
+ */
+export const PLUGIN_RULE_DIR = '.config/oxlint-plugin/rules/'
+export const PLUGIN_TEST_DIR = '.config/oxlint-plugin/test/'
+
+/**
+ * True when `filename` is inside the plugin's own rules / test directory.
+ */
+export function isPluginInternalPath(filename: string): boolean {
+  return (
+    filename.includes(PLUGIN_RULE_DIR) || filename.includes(PLUGIN_TEST_DIR)
+  )
+}
+
+/**
+ * True when `filename` points at the fleet-canonical `scripts/paths.mts`.
+ */
+export function isPathsModule(filename: string): boolean {
+  return filename.endsWith(PATHS_FILE)
+}

.config/oxlint-plugin/rules/no-file-scope-oxlint-disable.mts

@@ -26,23 +26,17 @@
  *     rule).
  */
 
+// Path-recognition helpers shared with sibling rules. See
+// `../lib/fleet-paths.mts` for the rationale behind each exemption.
+import {
+  isPathsModule,
+  isPluginInternalPath,
+} from '../lib/fleet-paths.mts'
 import type { AstNode, RuleContext } from '../lib/rule-types.mts'
 
 const FILE_SCOPE_DISABLE_RE =
   /^\s*(?:\/\*|\/\/)\s*oxlint-disable(?!-next-line)\s+/
 
-// Plugin-internal rule files are allowed to file-scope-disable their
-// own rule (the banned shape is lookup-table data in the rule
-// definition). Match by suffix on the path.
-const PLUGIN_RULE_DIR = '.config/oxlint-plugin/rules/'
-const PLUGIN_TEST_DIR = '.config/oxlint-plugin/test/'
-
-function isPluginInternalPath(filename: string): boolean {
-  return (
-    filename.includes(PLUGIN_RULE_DIR) || filename.includes(PLUGIN_TEST_DIR)
-  )
-}
-
 const rule = {
   meta: {
     type: 'suggestion',
@@ -62,7 +56,7 @@ const rule = {
 
   create(context: RuleContext) {
     const filename = context.filename ?? context.getFilename?.() ?? ''
-    if (isPluginInternalPath(filename)) {
+    if (isPluginInternalPath(filename) || isPathsModule(filename)) {
       return {}
     }
     const sourceCode = context.getSourceCode