feat(allowlist): add Handlebars and Mustache support

[yepYoung]

Description

Add first-class review support for Handlebars and Mustache templates as the focused subtask tracked in #1081:

• recognize .hbs and .mustache files case-insensitively;
• keep template files under test/ and tests/ reviewable because these ecosystems do not share a reliable default template-test convention;
• route both extensions to a focused review rule covering escaping boundaries, template and partial selection, missing values and helpers, context mistakes, structured output, and render-time performance;
• add positive, uppercase, exclusion, and rule-resolution coverage;
• document the built-in mapping in all five review-rules locale pages.

The contribution stays limited to these two extensions. Other template engines remain outside this PR.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that causes existing functionality to change)
• Refactoring (no functional changes)
• Documentation update
• CI / Build / Tooling

How Has This Been Tested?

• make test passes locally
• Manual testing (described below)

Validation performed on macOS/arm64 with Go 1.26.5:

• make check
• make test (race detector and -count=1)
• make build
• make coverage (91.1%, above the 90% threshold)
• Pages lint, 32 tests, typecheck, production build, bundle-size check, and HTTP smoke checks
• Translation-sync tests and documentation locale check
• git diff --check upstream/main...HEAD

The repository-required ocr review --audience agent --background <context> command was attempted, but this local environment has no configured LLM endpoint. ocr review --preview completed successfully, and I performed a separate line-by-line self-review.

Checklist

• My code follows the project's coding style (go fmt, go vet)
• I have performed a self-review of my code
• I have added tests that prove the feature works
• New and existing unit tests pass locally with my changes
• I have updated the documentation accordingly
• I have signed the CLA

Related Issues

Closes #1081

Part of #470

[github-actions]

✅ OpenCodeReview: Review complete: 0 finding(s) across 2 selected item(s).

[CLAassistant]

All committers have signed the CLA.

[wu21-web]

Why doesn't this block have a item where want is true? It is optional but all other blocks have at least one item that has want set to true.

[wu21-web]

A example suggestion might be:

Suggested change

	// Handlebars/Mustache templates have no conventional default test-file exclusion.
	{"handlebars template in tests directory", "tests/templates/card.hbs", false},
	{"mustache template in test directory", "test/templates/email.mustache", false},
	// Handlebars/Mustache templates have no conventional default test-file exclusion.
	{"handlebars template in tests directory", "tests/templates/card.hbs", false},
	{"mustache template in test directory", "test/templates/email.mustache", false},
	{"mustache files", "src/source.mustache", true},
	{"handlebars source files", "src/code.hbs", true},

[yepYoung]

Thanks for pointing this out. I added want: true cases for .hbs and .mustache under the existing generic **/fixtures/** exclusion, while keeping ordinary test/templates paths at false.

In TestIsExcludedPath, want: true means the path is excluded from review, so using ordinary src/*.hbs or src/*.mustache source files as the true cases would skip the templates this PR is adding support for. The fixture cases now cover the excluded side without changing the intended behavior.

[wu21-web]

Is a default exclude pattern needed for those files?

For example:

"**/test/**/*.{hbs,mustache}",
"**/tests/**/*.{hbs,mustache}",
"**/spec/**/*.{hbs,mustache}"

[yepYoung]

Good question. I did not add extension-specific exclusions for all test, tests, or spec directories. #470 lists no required default exclusion for Template Engines, and this repository already excludes generic fixtures, testdata, and __snapshots__ paths.

A broad directory rule could exclude real Handlebars/Mustache templates based only on their location. The updated tests therefore keep ordinary test/templates paths reviewable while proving that templates under existing fixture paths are still excluded. If the maintainers prefer the broader exclusion as a project-level policy, I’m happy to adjust it.

[wu21-web]

Why are there unwanted extensions here?
I mean if those unwanted extensions are not in the allowed_extensions.json in the first place. There is no need to be over explicit.
This should be handled by the {"", false}, currently on R103 in your branch.
Deleting these 2 items also aligns the format.

Suggested change

	{".hbsx", false},
	{".mustachex", false},

[yepYoung]

Agreed. I removed the .hbsx and .mustachex cases. The shared unsupported-extension cases already cover the false path, and the updated block now matches the surrounding test style.

[lizhengfeng101]

LGTM