docs(npm): bound Pattern's doc and name the short-read fail-open

What

Expands two doc comments in internal/format/npm/virtual_rules.go.

The Pattern comment names the schema length bound and the matcher cost. The VirtualRulesFrom comment states that a short datastore read fails open, so callers must pass the complete rule set.

Why this is separate

The gaps surfaced during review of an OCI mirror. The changed adapter is npm virtual code and belongs to S31. It changes neither the S32 OCI specification (!2240) nor the S32 implementation plan (!2276 (merged)).

Keeping this change separate preserves focused npm code-owner review and avoids an unrelated cross-format change in an OCI specification MR.

Checks

Doc comments need no behavior or test change.

Related to #291