docs: qualify the AB7014 prebuilt-payload scan by JavaScript extension (#577)

Author: ScriptedAlchemy

website/docs/en/guide/distribution/validation.mdx

@@ -198,9 +198,10 @@ entry is therefore only for what the packed files demonstrably need from outside
 — a package a packed module still imports because the author kept it external through the
 [`tools` hatch](../../reference/configuration.mdx#tools) (possible in the package build's `dist`
 output, which `AB6005` does not walk; a host-pack module with that import fails the build), one a
-prebuilt payload module imports (prebuilt files are opaque to `AB6005` but are scanned for
-`AB7014`), one a consumer-side install script runs, one whose `bin` a packed file executes, or one
-a packed declaration file references — and `AB7014` reports a declared dependency with none of that
+prebuilt `.js`/`.mjs`/`.cjs` payload module imports (prebuilt files are opaque to `AB6005`, and
+`AB7014` scans only those extensions, so an extensionless prebuilt module counts for nothing), one
+a consumer-side install script runs, one whose `bin` a packed file executes, or one a packed
+declaration file references — and `AB7014` reports a declared dependency with none of that
 evidence, while `AB7015` reports one a consumer's npm cannot install.
 
 | Code | Meaning |

website/docs/zh/guide/distribution/validation.mdx

@@ -173,7 +173,8 @@ CLI、MCP 入口、钩子包装层以及包构建的 JavaScript bundle——都
 从产物之外加载的只有内建模块。因此，`dependencies` 条目只留给打包后的文件有据可证地需要从已编译 bundle 之外
 获取的内容——打包后的模块因作者通过 [`tools` 逃生舱](../../reference/configuration.mdx#tools)将其保持外部化
 而仍然导入的包（这在包构建的 `dist` 输出中是可能的，因为 `AB6005` 不会遍历它；带有这种导入的宿主包模块则会
-让构建失败），预构建 payload 模块导入的包（预构建文件对 `AB6005` 不透明，但会被 `AB7014` 扫描），消费者侧
+让构建失败），预构建的 `.js`/`.mjs`/`.cjs` payload 模块导入的包（预构建文件对 `AB6005` 不透明，而
+`AB7014` 只扫描这些扩展名，因此无扩展名的预构建模块不算任何证据），消费者侧
 安装脚本运行的包，打包后的文件执行其 `bin` 的包，或打包后的声明文件引用的包——
 `AB7014` 会报告不具备上述任何一种证据的已声明依赖，而 `AB7015` 会报告消费者的 npm 无法安装的依赖。