feat(cicd_rules): extend :typescript_detected with linguist + /deps/ + /vscode/ carve-outs (#378)

## Summary

Extends `:typescript_detected` `path_allow_prefixes` from 7 to 9
carve-out classes, closing asymmetries surfaced by the 2026-05-28 estate
inventory.

## Three new classes

- **`linguist/`** — hyperpolymath fork of `github-linguist/linguist`;
its `samples/TypeScript/*.ts` are ML training fixtures, not
estate-authored. Same class as `rescript/`/`servers/`/`repos-monorepo/`.
- **`/deps/`** — Elixir Mix vendored-dep dir. Exemplar:
`tma-mark2/deps/phoenix_live_view/assets/js/phoenix_live_view/*.ts`
ships Phoenix LiveView's authored TS, vendored as a hex-mix dep.
- **`/vscode/`** — VSCode extension entry points across 5 estate repos
(`universal-language-server-plugin`, `reposystem`, `proof-burrower`,
`phronesis`, `bofj-kitt`). Each has a `vscode/extension.ts`. Blocked on
AffineScript VSCode-extension API binding (top-50 roadmap, unshipped);
carve-out unblocks the gate.

## Test plan

- [x] +3 tests for the new classes (linguist combined with existing fork
test; new `**/deps/`; new `**/vscode/**` test covering all 5 estate
repos)
- [x] Existing 8 tests unmodified
- [x] No behaviour change for the existing 7 carve-out classes
- [ ] CI green

## Related

- Mirrors will land in standards (`.claude/CLAUDE.md` exemption table +
`LANGUAGE-POLICY.adoc` carve-outs + `language-policy.yml` grep chain)
- Parent: hypatia#375 (initial 7-class TS carve-out)
- Tracker: project_estate_ts_to_affinescript_2026_05_28

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: hyperpolymath

lib/rules/cicd_rules.ex

@@ -67,7 +67,7 @@ defmodule Hypatia.Rules.CicdRules do
     # TS ban (org policy 2026-04-30 for NEW files; existing TS grandfathered
     # while in-flight migration to AffineScript proceeds — see project
     # tracker `project_estate_ts_to_affinescript_2026_05_28.md`).
-    # Path-prefix allowlist covers seven classes of legitimate `.ts` presence:
+    # Path-prefix allowlist covers nine classes of legitimate `.ts` presence:
     #
     # (1) Declaration files (`.d.ts`) — FFI/library type definitions are
     #     headers, not implementation; they're the boundary, not the code.
@@ -93,10 +93,21 @@ defmodule Hypatia.Rules.CicdRules do
     #
     # (6) Upstream forks not estate-authored — `rescript/` (ReScript
     #     compiler), `servers/` (third-party MCP servers),
-    #     `repos-monorepo/` (mass aggregator).
+    #     `repos-monorepo/` (mass aggregator), `linguist/` (GitHub's
+    #     language classifier — TS in `samples/` is ML training data).
     #
     # (7) Archived repos — GitHub-archived repos cannot accept PRs;
     #     their TS is dormant. `hyperpolymath-archive/**`.
+    #
+    # (8) Vendored package-manager deps — `**/deps/` covers Elixir Mix
+    #     vendored deps (canonical example: `tma-mark2/deps/phoenix_live_view/`
+    #     ships Phoenix LiveView's authored TS). We don't own this code.
+    #
+    # (9) Editor-host extensions — `**/vscode/**` covers VSCode extension
+    #     entry points (`extension.ts` lives under `editors/vscode/`,
+    #     `extensions/vscode/`, or `clients/vscode/`). Blocked on the
+    #     AffineScript VSCode-extension API binding (top-50 roadmap);
+    #     carve-out unblocks the policy gate until bindings ship.
     %{id: :typescript_detected, glob: "*.ts",
       reason: "TypeScript banned in NEW code -- use AffineScript (org policy 2026-04-30; existing TS grandfathered while in-flight migration proceeds, see project_estate_ts_to_affinescript_2026_05_28)",
       # check_pattern uses String.contains?/2 so these entries match as
@@ -120,12 +131,28 @@ defmodule Hypatia.Rules.CicdRules do
         # (5) Bootstrap shims
         "affinescript-deno-test/",
         "affinescript-cli/",
-        # (6) Upstream forks
+        # (6) Upstream forks — not estate-authored; TS exists as vendored
+        # upstream code or sample fixtures (linguist ships `.ts` files in
+        # `samples/` as classification training data for its ML model).
         "rescript/",
         "servers/",
         "repos-monorepo/",
+        "linguist/",
         # (7) Archived repos
-        "hyperpolymath-archive/"
+        "hyperpolymath-archive/",
+        # (8) Vendored package-manager deps — `deps/` is the canonical Elixir
+        # Mix vendored-dep directory (also used by other tools that vendor
+        # via that name). Exemplar: `tma-mark2/deps/phoenix_live_view/`
+        # ships Phoenix LiveView's authored TS.
+        "/deps/",
+        # (9) Editor-host extensions — VSCode extension entry points target
+        # the `vscode` extension-host API which AffineScript does not yet
+        # bind. These are blocked on the AS-bindings top-50 roadmap; the
+        # carve-out unblocks the gate until host-API bindings ship.
+        # Exemplars: `*/editors/vscode/`, `*/extensions/vscode/`,
+        # `*/clients/vscode/`. The bare `/vscode/` substring suffices since
+        # `String.contains?/2` matches any path containing it.
+        "/vscode/"
       ]},
     %{id: :rescript_detected, glob: "*.res", reason: "ReScript banned -- use AffineScript (org policy 2026-05-25; see #57 migration assistant)"},
     %{id: :rescript_interface_detected, glob: "*.resi", reason: "ReScript banned -- use AffineScript (org policy 2026-05-25; see #57 migration assistant)"},

test/rules/cicd_rules_typescript_test.exs

@@ -79,16 +79,18 @@ defmodule Hypatia.Rules.CicdRules.TypescriptTest do
       assert Enum.find(results, &(&1.rule == :typescript_detected)) == nil
     end
 
-    test "exempts upstream-fork repos (rescript/servers/repos-monorepo)" do
+    test "exempts upstream-fork repos (rescript/servers/repos-monorepo/linguist)" do
       files = [
         "rescript/jscomp/test/test.ts",
         "servers/src/everything/index.ts",
-        "repos-monorepo/some/path/file.ts"
+        "repos-monorepo/some/path/file.ts",
+        "linguist/samples/TypeScript/classes.ts",
+        "linguist/samples/TypeScript/proto.ts"
       ]
 
       results = CicdRules.check_commit_blocks(files)
       assert Enum.find(results, &(&1.rule == :typescript_detected)) == nil,
-             "upstream forks are not estate-authored — vendored as-is"
+             "upstream forks are not estate-authored — linguist ships TS as ML training samples"
     end
 
     test "exempts hyperpolymath-archive/** (archived repos)" do
@@ -101,6 +103,32 @@ defmodule Hypatia.Rules.CicdRules.TypescriptTest do
       assert Enum.find(results, &(&1.rule == :typescript_detected)) == nil
     end
 
+    test "exempts **/deps/ vendored package-manager dirs (Mix etc.)" do
+      files = [
+        "tma-mark2/deps/phoenix_live_view/assets/js/phoenix_live_view/view_hook.ts",
+        "tma-mark2/deps/phoenix_live_view/assets/js/phoenix_live_view/index.ts",
+        "some-elixir-app/deps/some_dep/assets/foo.ts"
+      ]
+
+      results = CicdRules.check_commit_blocks(files)
+      assert Enum.find(results, &(&1.rule == :typescript_detected)) == nil,
+             "Mix-style vendored deps under /deps/ are not estate-authored"
+    end
+
+    test "exempts **/vscode/** editor-host extensions (blocked on AS-bindings)" do
+      files = [
+        "universal-language-server-plugin/clients/vscode/extension.ts",
+        "reposystem/tools/rsr-certified/extensions/vscode/src/extension.ts",
+        "proof-burrower/affinescript/editors/vscode/src/extension.ts",
+        "phronesis/editors/vscode/src/extension.ts",
+        "bofj-kitt/affinescript/editors/vscode/src/extension.ts"
+      ]
+
+      results = CicdRules.check_commit_blocks(files)
+      assert Enum.find(results, &(&1.rule == :typescript_detected)) == nil,
+             "VSCode extension entry points wait on AS VSCode-extension API binding"
+    end
+
     test "flags new TS even with carve-out-like names but outside carve-out paths" do
       # `proven/src/something.ts` is NOT in `proven/bindings/deno/`,
       # so it MUST still flag.