[P2] Bootstrap-secret parser matches commented / inline-comment lines

[Bccorb]

Severity: P2 — Bug

Where: src/core/bootstrapSecret.ts:14, 21, 29

Problem
/SEAMLESS_BOOTSTRAP_SECRET=(.*)/ (no anchors, no m flag) matches #SEAMLESS_BOOTSTRAP_SECRET=old, captures a trailing # comment into the secret, and takes the first match — so a stale/commented value can shadow the real one.

Suggested fix
Anchor to line start (ignore comments), trim inline comments, and prefer the last/effective assignment.

Filed from an internal code audit (2026-07). File references are against main at audit time.