Fix missed imports and comment-based crypto findings

[script3r]

An OpenSSL include following a copyright comment was skipped by the whole-file hint, while a commented-out EVP_aes_256_gcm() produced an AES-GCM finding.

Compile conservative include hints by removing zero-width regex assertions from regex-syntax's parsed representation. The original regexes still decide whether AST import nodes anchor a library. This covers ^, $, \A, \z, and nested assertions without string-based regex rewriting, while continuing to reject files with no relevant text.

Mask Tree-sitter comment spans before API fallback, algorithm matching, and constant collection. Preserve byte offsets, line endings, and string contents so evidence remains accurate. Both standalone comments and comments nested inside call nodes are covered. This does not add data-flow analysis or suppress ordinary strings/docstrings.

Validation: seven focused regression tests, all existing ground-truth fixtures, library and minimal-feature tests, formatting, and all-target Clippy with warnings denied under all and minimal features. patterns.toml and all fixtures remain unchanged. regex-syntax was already present transitively and is now a direct dependency.

Part 2 of the review series; independent of #14 and based on main.