v3.1.33

• Block-comment stripping: rules no longer fire on commented-out /* */ code (string-aware, C-style languages only; YAML/Python/shell use # and are unaffected)
• Eight rule narrowings cut false positives: MD5/SHA-1 checksums vs password hashing, static-literal NoSQL operators, parameterized + hashed SQL queries, ownership-scoped updates, confirm-password/emptiness checks, UI message strings, and test (.spec) files
• One rule relabeled to ORM/NoSQL query injection; rule/tool counts unchanged (433/36), self-audit clean, determinism preserved