feat(rules): :nodejs_detected — add /bindings/rescript/ carve-out (post #275 closeout cleanup) (#412)

## Summary

Surfaced during the hyperpolymath/standards#275 STEP 7 closeout
**estate-wide hypatia scan**:
`proven-servers/bindings/rescript/package-lock.json` was the single
uncarved hit across 20 estate-wide `package-lock.json` files.

The `rescript` variant is **host-required for the rescript-to-js compile
chain** (same pattern as JS/TS consumer exports, just produced from
`.res` sources) and is symmetric to the existing `/bindings/javascript/`
and `/bindings/typescript/` carve-out class (5c).

## Changes

**`lib/rules/cicd_rules.ex`** — carve-out class 5c extended:

| Before | After |
|---|---|
| `/bindings/javascript/` | `/bindings/javascript/` |
| `/bindings/typescript/` | `/bindings/typescript/` |
| — | `/bindings/rescript/` |

Comment block updated to reflect the rescript variant + reference the
standards#275 STEP 7 surfacing context.

**`test/rules/cicd_rules_rescript_npm_js_test.exs`** — 1 new test case
in the `nodejs_detected rule` describe block asserting that lockfiles
under any of the three sibling consumer-export bindings paths are
exempt.

## Why this closes the loop

The standards#253 closeout PR
(hyperpolymath/standards#325) merged
2026-05-31T07:11Z, declaring the npm → Deno migration "substantially
complete" with "zero `:nodejs_detected` flags outside carve-outs". The
estate-wide scan during that closeout's STEP 7 audit
(hyperpolymath/standards#275) surfaced one
uncarved hit. This PR makes the closeout declaration **exactly true**
(was 19/20 prior).

## Test plan

- [ ] CI: existing nodejs_detected suite passes
- [ ] New test: `exempts */bindings/{javascript,typescript,rescript}/
consumer exports` passes (already syntactically validated via
`Code.string_to_quoted!`)
- [ ] Hypatia self-scan: no false-positive flagging on
`proven-servers/bindings/rescript/`

Refs hyperpolymath/standards#253 (umbrella, CLOSED 2026-05-31)
Refs hyperpolymath/standards#275 (STEP 7, CLOSED 2026-05-31)
Refs #405 (predecessor — first batch of class-5c carve-outs added
vscode-*, tree-sitter-*, Lake, Office, javascript/typescript bindings)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

lib/rules/cicd_rules.ex

@@ -305,12 +305,19 @@ defmodule Hypatia.Rules.CicdRules do
         #      ship via npm because the Office host loads `.js` from a
         #      Node-packaged manifest). Parallel to VSCode extension carve-out.
         "/office-addin/",
-        # (5c) Estate "bindings/{javascript,typescript,deno}/" subdirs are
-        #      consumer-facing exports of estate-internal proven libraries
-        #      to npm-consuming downstreams (parallel to /bindings/deno/
-        #      under :typescript_detected). NOT estate-internal npm use.
+        # (5c) Estate "bindings/{javascript,typescript,rescript,deno}/"
+        #      subdirs are consumer-facing exports of estate-internal proven
+        #      libraries to npm-consuming downstreams (parallel to
+        #      /bindings/deno/ under :typescript_detected). NOT
+        #      estate-internal npm use. The rescript variant is
+        #      host-required for the rescript-to-js compile chain (same
+        #      pattern as JS/TS consumer exports, just produced from .res
+        #      sources). Surfaced during standards#275 STEP 7 closeout
+        #      estate-wide scan (proven-servers/bindings/rescript/ was the
+        #      single uncarved hit).
         "/bindings/javascript/",
         "/bindings/typescript/",
+        "/bindings/rescript/",
         # (6) Example / test fixtures
         "/example/",
         "/examples/",

test/rules/cicd_rules_rescript_npm_js_test.exs

@@ -188,6 +188,19 @@ defmodule Hypatia.Rules.CicdRules.RescriptNpmJsTest do
       assert Enum.find(results, &(&1.rule == :nodejs_detected)) == nil,
              "example/fixture lockfiles demonstrate npm consumer — not own toolchain"
     end
+
+    test "exempts */bindings/{javascript,typescript,rescript}/ consumer exports" do
+      files = [
+        "proven-servers/bindings/javascript/package-lock.json",
+        "proven-servers/bindings/typescript/package-lock.json",
+        "proven-servers/bindings/rescript/package-lock.json"
+      ]
+
+      results = CicdRules.check_commit_blocks(files)
+
+      assert Enum.find(results, &(&1.rule == :nodejs_detected)) == nil,
+             "consumer-facing language bindings under /bindings/{js,ts,res}/ ship to npm-consuming downstreams (parallel to /bindings/deno/ under :typescript_detected); the rescript variant is host-required for the rescript-to-js compile chain"
+    end
   end
 
   # ---------------------------------------------------------- Unnecessarily-JS