docs(npm-exemptions): mirror hypatia#412 /bindings/rescript/ carve-out (post #275 closeout cleanup) (#328)

## Summary

Surfaced during the standards#275 STEP 7 closeout **estate-wide hypatia
scan**: `proven-servers/bindings/rescript/package-lock.json` was the
single uncarved hit across 20 estate-wide `package-lock.json` files.

[hypatia#412](hyperpolymath/hypatia#412) extends
the `:nodejs_detected` rule's class 5c
(`/bindings/{javascript,typescript}/`) to also cover
`/bindings/rescript/`. This PR **mirrors that to the
LANGUAGE-POLICY.adoc Node.js narrative row**, matching the docs-vs-rule
parity pattern from hypatia#405 + standards#320.

## Change

`rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc` Node.js
banned-language row:

| Before | After |
|---|---|
| "nine carve-out classes (six original + three added during the
migration via hypatia#405)" | "nine carve-out classes (six original +
three added during the migration via hypatia#405 + one added
post-closeout via hypatia#412 for `/bindings/rescript/` symmetry)" |
| Class (5): `**/bindings/{javascript,typescript}/**` | Class (5):
`**/bindings/{javascript,typescript,rescript}/**` with rationale "the
`rescript` variant is host-required for the rescript-to-js compile
chain" |

## Why post-closeout

The standards#253 closeout PR (#325) merged 2026-05-31T07:11Z. The
campaign is officially complete. This PR makes the closeout declaration
"zero `:nodejs_detected` flags outside carve-outs" **exactly true** (was
19/20 prior) without re-opening #253 or #275.

Pairs with hyperpolymath/hypatia#412 (rule update + test). Both should
land together to maintain docs↔rule parity.

## Test plan

- [ ] CI green (text-only change)
- [ ] Cross-link to hypatia#412 PR description visible in this PR
comments
- [ ] Hypatia self-scan unchanged (rule is in hypatia repo, not
standards)

Refs #253 (umbrella, CLOSED 2026-05-31)
Refs #275 (STEP 7, CLOSED 2026-05-31)
Refs #320 (predecessor mirror PR pattern for hypatia#405)
Refs hyperpolymath/hypatia#412 (the rule update this mirrors)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc

@@ -191,7 +191,8 @@ NOTE: For full rationale and migration guides, see the link:{source-repo}[CCCP r
 | Insecure by default. Detection via hypatia
   `cicd_rules/nodejs_detected` (matches `package-lock.json`) with
   `path_allow_prefixes` covering nine carve-out classes (six original
-  + three added during the migration via hypatia#405):
+  + three added during the migration via hypatia#405 + one added
+  post-closeout via hypatia#412 for `/bindings/rescript/` symmetry):
   (1a) `**/vscode/**` VSCode extension host-required toolchain;
   (1b) `vscode-` substring (extension repos/subdirs);
   (1c) `tree-sitter-` substring (grammar npm-publish targets, Class C
@@ -201,8 +202,9 @@ NOTE: For full rationale and migration guides, see the link:{source-repo}[CCCP r
   forks;
   (4) `hyperpolymath-archive/**` archived repos;
   (5) `**/deps/**`, `**/node_modules/**`, `**/.lake/**` (Lean4),
-  `**/office-addin/**`, `**/bindings/{javascript,typescript}/**`
-  vendored / host-required / consumer-export deps;
+  `**/office-addin/**`, `**/bindings/{javascript,typescript,rescript}/**`
+  vendored / host-required / consumer-export deps (the `rescript`
+  variant is host-required for the rescript-to-js compile chain);
   (6) `**/example/**`, `**/examples/**`, `**/test-fixtures/**`,
   `**/fixtures/**` example/test fixtures.
   *Migration substantially complete 2026-05-31* under umbrella