ci: add .mjs to check-comment-blocks.sh + check-issue-refs.sh's scope

mara: "add mjs to the lint and fix it in this pr". Both lints scope their
git ls-files scan to a fixed extension list that never included .mjs, so
all three frontend build.mjs files (swarm-ui, dashboard, agent) were
completely invisible to both -- not merely under the limits, outside the
scan entirely.

check-comment-blocks.sh: added '*.mjs' to the ls-files glob and to the
mode_of regex (same slash-comment treatment .js/.ts/.tsx already get --
.mjs is the same comment syntax, argus's exact proposed fix). check-issue-refs.sh:
added '*.mjs' to its glob list, no regex change needed.

Fixing the scope immediately surfaced real, pre-existing violations in
the other two build.mjs files (swarm-ui's own is already handled by this
PR's earlier commits):
- dashboard/build.mjs: 49-line comment block (trimmed to 15 -- redundant
  per-file output-layout table cut, the code below already names every
  output path) plus three bare tracker tags (#448 x2, #453) in the
  stream-worker comment, reworded to prose
- agent/build.mjs: two bare tracker tags (hyperhive#3685 x2), reworded

No logic changes anywhere -- comment-only edits plus the two lint
scripts. Closes #4300 and (independently filed, consolidated into that
one) #4299.

scripts/check-issue-refs.sh

@@ -11,8 +11,8 @@
 # Emits a CI error annotation per hit, exits 1 if any hit is found. Its own
 # required CI job (branch protection) — a hit blocks merge.
 #
-# Scope: every tracked `*.rs *.nix *.js *.ts *.tsx *.css *.html *.md *.yml
-# *.yaml`. CI workflow files (`.forgejo/workflows/*.yml`) are explicitly in
+# Scope: every tracked `*.rs *.nix *.js *.mjs *.ts *.tsx *.css *.html *.md
+# *.yml *.yaml`. CI workflow files (`.forgejo/workflows/*.yml`) are explicitly in
 # scope: a step comment is still a comment. The pattern matches a hash,
 # 2-5 digits, then a non-alphanumeric char or end-of-line (skips
 # letter-bearing hex colours and digit-runs-then-letter, e.g. `#24h`;
@@ -33,7 +33,7 @@ pattern='#[0-9]{2,5}([^0-9a-zA-Z]|$)|/issues/[0-9]+([^0-9a-zA-Z]|$)'
 # an empty file list. Lines carrying the `lint:allow` marker are dropped
 # (legitimate non-tracker hit; see the header).
 hits="$(
-  git ls-files -z '*.rs' '*.nix' '*.js' '*.ts' '*.tsx' '*.css' '*.html' '*.md' \
+  git ls-files -z '*.rs' '*.nix' '*.js' '*.mjs' '*.ts' '*.tsx' '*.css' '*.html' '*.md' \
     '*.yml' '*.yaml' \
     | xargs -0 -r grep -nE "$pattern" /dev/null 2>/dev/null \
     | grep -v 'lint:allow' || true