fix(security): avoid regex comment stripping for #366

[Luis85]

Summary

Addresses the CodeQL security review surfaced on #366 without pushing directly to main.

• replaces the HTML/CSS comment-stripping regex path in tests/scripts/sites-no-hex-literals.test.ts with delimiter scanning that preserves newlines
• tightens the JS/TS line-comment regex so it does not consume newline characters
• adds focused coverage for comment stripping and malformed nested HTML comment input

After this merges into main, PR #366 (main -> demo) will include the fix on its head branch.

Verification

• npm run test:scripts -- tests/scripts/sites-no-hex-literals.test.ts
• npm run typecheck:scripts
• npm run verify

Related

• Security review thread on chore(release): promote main -> demo for v0.6.0 #366: CodeQL / Incomplete multi-character sanitization