docrot v1.4.0 — HTML comments no longer counted as image references

v1.4.0 — HTML comments are no longer counted as image references

Fix: image-looking syntax inside <!-- ... --> comments no longer enters the reference dataset. Comment content is never rendered — the fourth false-positive family this project has closed (examples/code → entities → fenced & inline code in the API → comments).

Found by the parity ritual: the paid API (docrot-scan-api v1.3.0) strips HTML comments in all three extractors; checking scanner↔API parity pointed back at the scanner itself, which still counted them.

Implementation: strip_html_comments blanks each comment with same-length whitespace (newlines preserved), wired into extract_image_refs after strip_code.

Dataset integrity: every upstream finding in waves 1–3 was hand-verified before filing, so no report is affected; only aggregate reference counts may include a small number of commented-out images. The outcomes ledger is unchanged.

Verification: repro before (commented ![dead](…) flagged as reference), clean after; 2 new regression tests — suite 72 → 74 green.