feat(rules): :nodejs_detected — add vscode-*, tree-sitter-*, Lake, Office, bindings carve-outs (standards#253)

[hyperpolymath]

Summary

STEP 3 of campaign #253 (npm → Deno estate migration). Carve-out gap-fix surfaced during the smallest-first batch.

Expands :nodejs_detected path_allow_prefixes to cover ~10 false-positive manifest classes:

• vscode- substring — VSCode-* extension repos / subdirs not under /vscode/ segment
• tree-sitter- substring — tree-sitter grammar npm-publish targets with node-gyp native binding (Class C)
• /.lake/ — Lean4 vendored packages
• /office-addin/ — Office.js add-in host-required toolchain
• /bindings/javascript/, /bindings/typescript/ — consumer-facing estate exports

These are all legitimate non-migrate-able npm manifest cases. Adding them as carve-outs prevents incorrect migration PRs against e.g. vscode-k9, tree-sitter-a2ml, proven/bindings/typescript/.

Test plan

• Hypatia rule-engine unit tests pass.
• Re-scan against the estate produces zero flags for the named carve-out classes.
• Truly migrate-able manifests (e.g. coq-jr/package.json, civic-connect/indieweb2-bastion/package.json) still flag — verified by current STEP-3 batch (~13 PRs filed against repos NOT in the new carve-out classes).

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 103 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	103

View findings

[
  {
    "reason": "Action urin 21 JRE\n        uses: actions/setup-java@be666c2fcd27 needs attention",
    "type": "unpinned_action",
    "file": "verify-proofs.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in clusterfuzzlite.yml",
    "type": "missing_timeout_minutes",
    "file": "clusterfuzzlite.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence