fix(rules): advisory.ts's isCodePath is missing .mts/.cts/.mjs/.cjs/.kts/.scala/.groovy that isCodeFile recognizes

[JSONbored]

⚠️ Definition of Done: this issue must be completed in full, in a single PR. Do not split this
work across multiple PRs, and do not defer any Deliverable below to a follow-up issue. A PR that
satisfies only some of the Deliverables, stubs a required test, or leaves a checkbox
partially-done does NOT resolve this issue and will be closed.

Context

Mirror this exact pattern: test/unit/rules.test.ts:1576-1614 already contains three
regression tests for this precise bug class — isCodePath/isCodeFile extension drift —
titled "flags Missing test evidence for Vue/Svelte/Astro source via isCodePath + isCodeFile parity", "...for .cc/.hpp C++ source...", and "...for Dart source...". Each fixes a prior
instance where isCodeFile (the engine's canonical "is this a real source file" predicate) was
updated but advisory.ts's own isCodePath copy fell behind. This issue is the same fix for a
fourth, still-open set of extensions.

isCodePath (src/rules/advisory.ts:553-555) is a host-only helper — it has no counterpart in
packages/loopover-engine/src/advisory/gate-advisory.ts (the engine twin, which doesn't implement
check-run annotations at all). Its own surrounding comment says it is meant to admit "genuine
source", mirroring isCodeFile (#2722's original alignment). Its current regex:

function isCodePath(path: string): boolean {
  return /\.(ts|tsx|js|jsx|py|go|rs|java|rb|php|cs|cpp|cc|c|h|hpp|swift|kt|m|sql|yaml|yml|json|toml|md|vue|svelte|astro|dart)$/i.test(path);
}

The canonical predicate it is meant to mirror, isCodeFile
(packages/loopover-engine/src/signals/test-evidence.ts:41-44), is defined as
isSourcePath(file) || (EXTENDED_SOURCE_EXTENSION.test(file) && ...), where:

// packages/loopover-engine/src/signals/test-evidence.ts:23
const SOURCE_FILE_EXTENSION = /\.(ts|tsx|mts|cts|js|jsx|mjs|cjs|py|rb|rs|kt|kts|scala|java|cs|swift|groovy|go|sql)$/i;

isCodePath is missing seven extensions that SOURCE_FILE_EXTENSION (and therefore
isCodeFile) recognizes: .mts, .cts, .mjs, .cjs, .kts, .scala, .groovy
(confirmed directly: all seven return false against isCodePath's regex while isCodeFile
returns true for each).

annotatablePullRequestFiles (src/rules/advisory.ts:583-585) gates on isCodePath before
buildMissingTestEvidenceFinding (packages/loopover-engine/src/signals/slop.ts) ever runs its
own, correct isCodeFile-based check. So a PR whose only changed files use one of these seven
extensions (e.g. a .mts config-as-code module, a .kts Gradle build script, a .scala/.groovy
JVM source file) produces an empty annotatableFiles set — no "Missing test evidence" annotation
is ever placed on such a file, and because changedPaths (:656) is also empty in that case, the
generic per-finding annotation loop (:657-670) places zero annotations for any finding on
a PR whose changed files are entirely of these types. This does not affect what the gate decides
or what blocks a PR — buildMissingTestEvidenceFinding in
packages/loopover-engine/src/signals/slop.ts uses isCodeFile directly and is unaffected — only
whether the finding gets a GitHub inline check-run annotation pointer.

No existing test in test/unit/rules.test.ts covers any of these seven extensions — the file has
parity tests for Vue/Svelte/Astro, C/C++/hpp, and Dart (see the three tests cited above), but not
for TS/JS module-extension variants or JVM-scripting-language extensions.

Requirements

• isCodePath (src/rules/advisory.ts:553-555) must recognize .mts, .cts, .mjs, .cjs,
  .kts, .scala, and .groovy, in addition to every extension it already recognizes — bringing
  it back into parity with SOURCE_FILE_EXTENSION/isCodeFile.
• Do not remove or narrow any extension isCodePath currently recognizes — this is purely
  additive.
• Do not change isCodePath's signature, its callers (annotatablePullRequestFiles), or anything
  else about buildCheckRunAnnotations's behavior beyond which file extensions are now admitted.

Deliverables

• isCodePath in src/rules/advisory.ts recognizes all seven missing extensions
  (.mts, .cts, .mjs, .cjs, .kts, .scala, .groovy).
• A new regression test in test/unit/rules.test.ts, in the same style and adjacent to the
  three existing "...via isCodePath + isCodeFile parity" tests (lines 1576-1614), covering
  at least one file of each of the seven newly-recognized extensions, asserting each produces
  a "Missing test evidence" annotation via buildCheckRunAnnotations — mirroring the exact
  structure of the existing Vue/Svelte/Astro test (repoFullName/sourcePaths/files/
  collisions setup, buildCheckRunAnnotations(advisory, { files, collisions, pullNumber }, "standard"), then asserting annotations.some(...) for each path).

All of the above Deliverables are required in the same PR.

Test Coverage Requirements

99%+ Codecov patch coverage, branch-counted, on the changed line in src/rules/advisory.ts.

Expected Outcome

isCodePath recognizes the same set of source-file extensions as isCodeFile, so a PR whose
changed files are .mts/.cts/.mjs/.cjs/.kts/.scala/.groovy source gets the same
"Missing test evidence" inline check-run annotation any other recognized source-file PR already
gets — closing the fourth instance of this same drift-between-two-parity-lists bug class in this
file.

Links & Resources

• src/rules/advisory.ts:553-555 (isCodePath, the function to fix), :583-585
  (annotatablePullRequestFiles, the caller this gap affects)
• packages/loopover-engine/src/signals/test-evidence.ts:23 (SOURCE_FILE_EXTENSION), :28
  (isSourcePath), :41-44 (isCodeFile) — the canonical predicate isCodePath must mirror
• test/unit/rules.test.ts:1576-1614 (the three prior parity-regression tests for this exact bug
  class — the template to mirror)

[linear-code]

JSO-6477