feat(cicd_rules): Layer-1 path_allow_prefixes for RS/npm/JS bans (batch — standards#260/#261/#263) (#391)

## Summary

Single batched Layer-1 PR for **three** estate-campaign STEP 1
sub-issues:

- `hyperpolymath/standards#260` — ReScript→AffineScript Layer-1
(umbrella #252)
- `hyperpolymath/standards#261` — npm→Deno Layer-1 (umbrella #253)
- `hyperpolymath/standards#263` — Unnecessarily-JS→AffineScript Layer-1
(umbrella #254)

Batched because the changes are non-conflicting and the carve-out
classes share structural overlap (vscode, bootstrap shims, upstream
forks, archived, vendored deps). Mirrors the TS Layer-1 batch shape from
#375 + #378.

## Rule changes

| Rule | Status | Carve-out classes |
|---|---|---|
| `:rescript_detected` | extended | 8 — bsconfig, upstream forks,
archived, vendored, vscode, compiled output (lib/js, lib/es6, lib/bs),
bootstrap shims, Telegraf |
| `:rescript_interface_detected` | extended | same 8 |
| `:nodejs_detected` (package-lock.json) | extended | 6 — vscode,
bootstrap shims, upstream forks, archived, vendored, example/test
fixtures |
| `:javascript_detected` (*.js) | **NEW** | 8 — host-required
(mcp-bridge/, /plugins/), tooling configs (.config.{js,cjs,mjs}),
bootstrap shims, upstream forks, archived, vendored, compiled output
(/out/, /lib/js/, /.deno/), vscode |
| `:javascript_jsx_detected` (*.jsx) | **NEW** | same 8 |

JS ship-mode design question (umbrella#254 STEP 1) decided in favour of
HARD-BLOCK with extensive carve-outs; per-PR exemption via inline `//
hypatia: allow cicd_rules/javascript_detected -- <reason>` pragma.

## Tests

`test/rules/cicd_rules_rescript_npm_js_test.exs` — 15 representative
cases across all 4 rules (flag + per-carve-out exemption) mirroring
`cicd_rules_typescript_test.exs`.

Verified locally via standalone `elixirc` compile + sanity-check script
(15/15 pass). Local `mix test` blocked by Elixir 1.14 vs Phoenix dep
mismatch unrelated to this PR; CI runs on a compatible toolchain.

## Seam-finding origin

Identified as Layer-1 batch candidate during the umbrella filings
session 2026-05-30 (see [[feedback_fanout_and_seam_analyst_meander]] in
operator memory). The three STEP 1 sub-issues all cross-reference each
other and this batch.

## Test plan

- [ ] CI green (Elixir-compatible toolchain runs the new test file)
- [ ] No regression in `cicd_rules_typescript_test.exs` (orthogonal
rules)
- [ ] Manual scan of an estate repo confirms new rules don't fire on
legitimate paths

## Cross-references

- Refs hyperpolymath/standards#260 (RS STEP 1)
- Refs hyperpolymath/standards#261 (npm STEP 1)
- Refs hyperpolymath/standards#263 (JS STEP 1)
- Refs hyperpolymath/standards#252 (RS umbrella)
- Refs hyperpolymath/standards#253 (npm umbrella)
- Refs hyperpolymath/standards#254 (JS umbrella)
- Pattern: hypatia#375 + #378 (TS Layer-1)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath