fix(rules): skip JSDoc block comments in R-WEB-06 (document.* check)

Add `skip-comments: true` to R-WEB-06 so the `\bdocument\.` pattern
is not matched inside JSDoc `/** ... */` block comments or single-line
`//` comments.

This eliminates a false positive found during field testing of forge:
`lib/css/index.js:439` contains `* Parse document.` in a JSDoc block
comment, which triggered a blocking FAIL on a vendored CSS parser with
no actual DOM API calls.

`skip-comments: true` is already supported by `apply-patterns.py`
(block-comment state tracking added in a prior commit). No new
infrastructure needed — this is a one-line rule configuration change.

Test: add JSDoc comment containing `document.` to `web-apis` fixture
and assert R-WEB-06 fires exactly once (real call only, not comment).

Fixes: forge field test FP (2026-03-22)

Author: Solomon

rules/patterns.yaml

@@ -66,6 +66,7 @@
   pattern: "\\bdocument\\."
   scope: ["*.js"]
   severity: blocking
+  skip-comments: true
   message: "DOM APIs (document.*) are not available in GJS"
   category: web-apis
   fix: "GJS has no DOM. Use GObject/Clutter/St/GTK widgets instead."

tests/fixtures/web-apis/extension.js

@@ -1,10 +1,14 @@
 import {Extension} from 'resource:///org/gnome/shell/extensions/extension.js';
 
+/**
+ * Parse document.querySelectorAll results into an array.
+ * This is a JSDoc comment — document. here must NOT trigger R-WEB-06.
+ */
 export default class WebApisExtension extends Extension {
     enable() {
         setTimeout(() => {}, 100);
         const xhr = new XMLHttpRequest();
-        document.querySelector('.foo');
+        document.querySelector('.foo'); // real DOM call — MUST trigger R-WEB-06
         clearTimeout(this._timer);
         clearInterval(this._interval);
     }

tests/run-tests.sh

@@ -123,6 +123,7 @@ assert_exit_code "exits with 1 (has failures)" 1
 assert_output_contains "fails on setTimeout" "\[FAIL\].*R-WEB-01"
 assert_output_contains "fails on XMLHttpRequest" "\[FAIL\].*R-WEB-04"
 assert_output_contains "fails on document.*" "\[FAIL\].*R-WEB-06"
+assert_output_count "R-WEB-06 fires exactly once (JSDoc comment skipped)" "\[FAIL\].*R-WEB-06" 1
 assert_output_contains "fails on clearTimeout" "\[FAIL\].*R-WEB-10"
 assert_output_contains "fails on clearInterval" "\[FAIL\].*R-WEB-11"
 echo ""