fix(rules): JS lockfile advice follows Bun-first runtime policy

[hyperpolymath]

lib/rules/root_hygiene.ex still told repos to "use Deno" and marked bun.lockb and pnpm-lock.yaml high / delete. That is the inverse of standards/docs/JS-RUNTIME-POLICY.adoc:

• The runtime order is Bun > pnpm > npm.
• Deno was banned on 2026-09-22 ("deno is over, we're prioritising bun, and using bunx").
• Bun lockfiles are "permitted and expected".

A dispatch acting on the old rule would delete a tier-1 lockfile.

File	Before	After
bun.lock / bun.lockb	high, delete ("Bun banned -- use Deno")	not flagged
pnpm-lock.yaml	high, delete	low, flag (tier 2)
package-lock.json, yarn.lock, .npmrc	banned, "use Deno"	banned, "use Bun"
nodejs_detected reason	"use Deno"	"use Bun", cites the policy doc

npx_in_workflow already recommended bunx / bun run, so it needed no change.

Verification: mix test gives 1702 tests, 0 failures (242 :verisim_data excluded, as on main), and mix format --check-formatted is clean. There are new tests asserting that Bun lockfiles are never flagged and that pnpm is never a delete.

Not changed: test/fixtures/a2ml/rsr-criteria-v2.a2ml (5.1.6 "use Deno") mirrors the standards criteria SSOT. It should be fixed at the source, in standards.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QFphKkDVB9pUDSCD4bkz65

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a60e2d40-e56c-4fa7-aaa8-a6d4ddfe374c

📥 Commits

Reviewing files that changed from the base of the PR and between 51bf019 and 28ab2e2.

📒 Files selected for processing (4)

• lib/rules/cicd_rules.ex
• lib/rules/root_hygiene.ex
• test/root_hygiene_test.exs
• test/rules/cicd_rules_rescript_npm_js_test.exs

 _______________________________________
< `NaN` is not a valid user experience. >
 ---------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• 🔴 Error committing to branch - (🔄 Check to retry)
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Autopilot could not be updated. Open Coding to check access and billing.

[coderabbitai]

❌ Failed to create Coding Agent finishing-touch task. Please try again.