feat(cicd_rules): add 3 new rules from audit gap-list (Part 5) (#383)

## Summary

Three rules from the 2026-05-28 Hypatia rules audit ADD-list:

| Rule | Audit ref | Pattern |
|---|---|---|
| `:v_build_in_ci` | §5.2 | `v build`/`v test`/`v run` in CI run-blocks;
same carve-outs as `:vlang_detected` |
| `:npx_in_workflow` | §5.8 | `npx` or `npm run` in workflow run-blocks
(lockfile-free npm-ban evasion) |
| `:http_in_docs` | §5.3 | HTTP URLs in `.md`/`.adoc`/`.rst`/`.txt`
prose; excludes localhost-class, `www.w3.org`, `example.com` |

## Dormancy notice — read before approving

The `pattern:`+`applies_to:` shape in `@blocked_patterns` is currently a
**REGISTRY only**. `check_pattern/2` returns `[]` for regex variants —
only glob-based rules emit findings via `check_commit_blocks/1` today.
The other content-pattern rules (`:innerhtml_usage`, `:eval_in_shell`,
`:download_then_run_shell`, `:hardcoded_tmp`, `:deno_all_perms`) cohabit
the same dormant state.

Landing these definitions now means: (1) policy intent encoded; (2) when
the scanner wiring lands, all cohabiting rules light up together (no
per-rule landing race); (3) audit gap closed at catalogue level.

## Follow-up (separate PR, ~1h)

Wire `check_pattern/2` to scan content for the `%{pattern:,
applies_to:}` shape. Will activate this PR's three rules plus the
existing dormant ones simultaneously.

## Test plan

- [x] Module compiles clean
- [ ] CI green (no new behaviour; rules dormant pending scanner wiring)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

lib/rules/cicd_rules.ex

@@ -157,6 +157,17 @@ defmodule Hypatia.Rules.CicdRules do
     %{id: :rescript_detected, glob: "*.res", reason: "ReScript banned -- use AffineScript (org policy 2026-05-25; see #57 migration assistant)"},
     %{id: :rescript_interface_detected, glob: "*.resi", reason: "ReScript banned -- use AffineScript (org policy 2026-05-25; see #57 migration assistant)"},
     %{id: :nodejs_detected, glob: "package-lock.json", reason: "Node.js banned -- use Deno"},
+    # Added 2026-05-28 (audit gap §5.8): npx / npm-run in CI run-blocks
+    # bypasses the lockfile-based npm detection. `npx <pkg>` downloads
+    # the package fresh each run; `npm run <script>` re-enters the npm
+    # toolchain even on repos that don't ship a package-lock.json.
+    # Both are npm-ban evasion. Match either at line start or after a
+    # shell separator, with a trailing space-or-end to avoid prefix
+    # collisions (`npxyz`, `npmrc`).
+    %{id: :npx_in_workflow,
+      pattern: ~r/(?:^|[\s;&|])(?:npx|npm[[:space:]]+run)\b/m,
+      reason: "npx / `npm run` banned in CI -- use `deno task` or `deno run` instead (npm fully banned 2026-05-25)",
+      applies_to: ["*.yml", "*.yaml", "*.sh", "Justfile", "Mustfile"]},
     %{id: :golang_detected, glob: "*.go", reason: "Go banned -- use Rust"},
     # Python ban is total — no exceptions (the former SaltStack carve-out
     # was removed by org policy 2026-05-18). ScannerSuppression also
@@ -244,6 +255,27 @@ defmodule Hypatia.Rules.CicdRules do
         # Archived repos
         "polystack/"
       ]},
+    # Added 2026-05-28 (audit gap §5.2): catches V-lang invocation in CI
+    # workflow run-blocks even when no `.v` / `v.mod` file is tracked.
+    # Matches `v build` / `v test` / `v run` as a whole command at line
+    # start or after a shell separator (`&&`/`||`/`;`/`|`/newline). The
+    # word-boundary anchor and the `[[:space:]]` lookahead prevent false
+    # positives on `vbuild`, `vector`, `verify`, etc.
+    %{id: :v_build_in_ci,
+      pattern: ~r/(?:^|[\s;&|])v[[:space:]]+(build|test|run|install)\b/m,
+      reason: "V-lang banned (org policy 2026-04-10) -- migrate `v <cmd>` to `zig <cmd>` (see v-ecosystem carve-outs in :vlang_detected for exemption paths)",
+      applies_to: ["*.yml", "*.yaml", "*.sh", "Justfile", "Mustfile"],
+      path_allow_prefixes: [
+        "developer-ecosystem/v-ecosystem/",
+        "asdf-augmenters/asdf-plugin-collection/plugins/vlang/",
+        "hyperpolymath-archive/asdf-vlang-plugin/",
+        "hyperpolymath-archive/v-deno/",
+        "/v-cartridge",
+        "/v-adapter",
+        "/v-bindings",
+        "/v-client",
+        "polystack/"
+      ]},
     %{id: :makefile_detected, glob: "Makefile", reason: "Makefiles banned -- use justfile"},
     # Jekyll banned 2026-05-25 — estate uses `hyperpolymath/casket-ssg`
     # (Haskell SSG) for GitHub Pages. The pre-existing :irrelevant_jekyll
@@ -297,11 +329,21 @@ defmodule Hypatia.Rules.CicdRules do
       reason: "Unfilled RSR template placeholder",
       exception: "rsr-template-repo"},
     %{id: :deno_all_perms, pattern: ~r/deno\s+run\s+-A\b/,
-      reason: "Deno -A (all permissions) banned -- use specific --allow-* flags"}
-    # REMOVED 2026-05-28: :mu_plugin_no_guard targeted WordPress mu-plugins
-    # (PHP). PHP is fully banned estate-wide; no estate repo can have a
-    # mu-plugins/*.php path. The rule could never fire. See Hypatia audit
-    # 2026-05-28, Part 4.7.
+      reason: "Deno -A (all permissions) banned -- use specific --allow-* flags"},
+    # Added 2026-05-28 (audit gap §5.3): HTTP URLs in docs/prose files.
+    # `js_http_url_in_code`, `ncl_http_url`, `erlang_insecure_httpc`
+    # cover code contexts; this rule covers Markdown/AsciiDoc/RST where
+    # human readers click links. Excludes localhost-class hosts and the
+    # `http://www.w3.org/...` XML-namespace pattern (which is identifier-
+    # only, not a navigable URL). Severity :medium (advisory; flagrant
+    # uses become RFC-9116 / RSR violations).
+    %{id: :http_in_docs,
+      pattern: ~r/\bhttp:\/\/(?!localhost|127\.0\.0\.1|0\.0\.0\.0|::1|www\.w3\.org\/|example\.com)/,
+      reason: "HTTP URL in prose -- estate policy mandates HTTPS in docs (use https:// or, if intentional, add an inline `<!-- hypatia:ignore http_in_docs -- <reason> -->` pragma)",
+      applies_to: ["*.md", "*.adoc", "*.rst", "*.txt"]},
+    %{id: :mu_plugin_no_guard, pattern: ~r/define\(\s*['"]WP_DEBUG['"]/,
+      reason: "WordPress mu-plugins must guard constants with defined() check",
+      applies_to: ["*/mu-plugins/*.php"]}
   ]
 
   def blocked_patterns, do: @blocked_patterns