docs(bootstrap): document repo-convention exceptions in file header

Bugbot flagged 3 repo-convention violations on this file:
  - raw fetch() instead of httpJson
  - raw rmSync instead of safeDelete
  - inline e.message instead of errorMessage()

All three are intentional. The script runs BEFORE pnpm install, so
it cannot import @socketsecurity/lib (the very package it
bootstraps). Document the exceptions explicitly in the file header
so future readers (and bots) can see the constraint without
re-deriving it from the code.

Author: jdalton

scripts/bootstrap-from-registry.mts

@@ -14,6 +14,25 @@
  *
  * Pinned versions come from `pnpm-workspace.yaml`'s `catalog:` —
  * single source of truth.
+ *
+ * --- Repo-convention exceptions ---
+ *
+ * This script intentionally CANNOT depend on `@socketsecurity/lib`
+ * because it is the script that bootstraps that very package. The
+ * usual repo conventions therefore do not apply here:
+ *
+ *   - `fetch()` is used directly instead of `httpJson` from
+ *     `@socketsecurity/lib/http-request`.
+ *   - `rmSync` is used directly instead of `safeDelete` from
+ *     `@socketsecurity/lib/fs`.
+ *   - Caught errors use the inline `e instanceof Error ? e.message
+ *     : String(e)` pattern instead of `errorMessage()` from
+ *     `@socketsecurity/lib/errors`.
+ *
+ * These exceptions are intentional, narrow, and self-contained. Do
+ * not add other repo-convention violations here without documenting
+ * the reason in this header. Once `@socketsecurity/lib` is on disk
+ * (post-bootstrap), other scripts must use the helpers as normal.
  */
 
 import { spawnSync } from 'node:child_process'