fix: expand source policy extension coverage - #159

Summary

Expands the shared source-policy scanner from TypeScript-only files to executable JavaScript and TypeScript module sources under src/, then updates the policy test and design wording to describe that bundleable source surface consistently.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #152

ADR Impact

• ADR-021

Changes

• Add a canonical SOURCE_POLICY_EXTENSIONS inventory and walkSourceFiles() helper that includes JS, JSX, MJS, CJS, TSX, MTS, and CTS while excluding declaration files.
• Parse source-policy fixtures with the script kind that matches JS, JSX, TS, and TSX extensions so AST policy checks exercise the same helper over non-TS files.
• Add Q007 tests proving the walker includes every supported module extension and that JavaScript / JSX fixtures surface forbidden eval and dynamic import patterns.
• Update existing source-policy tests and design prose so they no longer describe the protected surface as only src/**/*.ts.
• Tighten Q004 listener self-tests to assert exact listener findings rather than weak prefix/count checks.

Test Plan

• Unit tests pass (make test)

• Integration tests pass if applicable (make integration)

• make check passes (Spotless, SpotBugs, Error Prone, Checkstyle, JaCoCo)

• No coverage regression

• pre-commit run --all-files

• pnpm lint && pnpm typecheck && pnpm test

• Codex review cycle: clean

• Test-quality review reported a weak assertion class; the assertions were tightened before push, with local completion gate green.

Ground Control Checks

• make policy passes
• gc_evaluate_quality_gates passes or is unchanged by this repo-only change
• gc_run_sweep reviewed; findings fixed or recorded with rationale

Traceability

• IMPLEMENTS: Issue Make source-policy gates cover every bundled source extension or ban JS under src #152 ← tests/runtime/source-policy.ts, Issue Make source-policy gates cover every bundled source extension or ban JS under src #152 ← tests/runtime/policy-q007-remote-code-execution.test.ts
• TESTS: Issue Make source-policy gates cover every bundled source extension or ban JS under src #152 ← tests/runtime/policy-q007-remote-code-execution.test.ts, Issue Make source-policy gates cover every bundled source extension or ban JS under src #152 ← tests/runtime/policy-q004-resource-cleanup.test.ts, Issue Make source-policy gates cover every bundled source extension or ban JS under src #152 ← pnpm lint && pnpm typecheck && pnpm test

Checklist

• Code follows project coding standards (docs/CODING_STANDARDS.md)
• No business logic in API layer
• Domain layer has no framework imports
• Envers @Audited on new entities if applicable
• Changelog fragment added at changelog.d/152.fixed.md
• Architectural docs updated if stack, package structure, or key behaviors changed