feat(devx): watch the comment-stripper family so a new private copy reds (#12372)

`scripts/js-comment-mask.mjs` exists because two private `stripComments`
families drifted apart in opposite directions. Nothing watched ADOPTION:
`check:comment-mask-corpus` verifies the shared mask against a real parser,
which is a claim about the module and says nothing about its callers. The
module landed, some callers were converted by hand, and the residue was
found by hand three separate times.

Add `scripts/check-comment-mask-adoption.mjs`: a spelling gate over
`packages/**` + `examples/**` that reds when a NEW private comment-stripper
appears, while the 23 measured pre-existing ones sit in a shrink-only
ledger and are not required to move first. Converting them is per-row and
deliberately not this gate's call.

Three points the implementation turns on:

* The scan masks comments with the very module it protects. Measured on
  1f6b8bb the naive-block-regex probe matches 17 files raw and 14
  masked: the three converted `canonical-expression-envelopes.test.ts`
  files now mention the old regex only in the prose explaining why they
  moved. An unmasked gate would red forever on the files that complied.

* A recorded row the scan no longer finds FAILS as stale, which turns "no
  findings" into "the recorded set is exactly reached". Ablating one
  detector reddens the production run with 3 stale rows instead of going
  quietly green.

* The population is declared as subtree globs, so the gate is reachable by
  `dispatch-gates` and the bare-root species is unreachable from it.

Not a widening of `check:parse-guard`: that gate governs the three
TypeScript parser entry points and its own header refuses a root broader
than `scripts/**` twice; widening its population would still catch no
stripper.


Claude-Session: https://claude.ai/code/session_01UjM2ia8Av1v5NqfqQEQmC6

Co-authored-by: Claude <noreply@anthropic.com>

Author: yinlianghui

.github/workflows/lint.yml

@@ -354,6 +354,42 @@ jobs:
       - name: scripts/ TypeScript parses go through one module
         run: pnpm check:parse-guard
 
+      # Nobody writes a NEW private comment-stripper (#12307).
+      # `scripts/js-comment-mask.mjs` exists because two private `stripComments`
+      # families drifted apart in opposite directions — one regex-based and
+      # blind to string literals, opening PHANTOM comments that delete real
+      # code; one string-aware but regex-blind, hiding real comments. What the
+      # tree had no instrument for was ADOPTION: `check:comment-mask-corpus`
+      # below verifies the shared mask against a real parser, which is a claim
+      # about the MODULE and says nothing about its callers. So the module
+      # landed, some callers were converted by hand, and the residue was found
+      # by hand three separate times — three cards for one conversion.
+      # This gate is the half that covers the caller nobody has written yet:
+      # a new private stripper reds on the PR that writes it, while the 23
+      # measured pre-existing ones sit in a shrink-only ledger and are NOT
+      # required to move first (a gate that reds on day one is a gate nobody
+      # can land). Converting them is per-row and deliberately not this gate's
+      # call.
+      # ⚠️ NOT a widening of `check:parse-guard` above: that gate governs the
+      # three TypeScript PARSER ENTRY POINTS and its own header refuses a root
+      # broader than `scripts/**` twice. Comment-stripping is a different
+      # subject, and widening that population would still catch no stripper.
+      # Its `--self-test` runs FIRST and is where the detectors are observed
+      # FIRING and, just as importantly, observed STAYING SILENT on an adopter
+      # and on prose — the live corpus is green by construction, so a passing
+      # production run alone cannot tell a working detector from a dead one.
+      # The ledger's stale-row equality is the other half: breaking a detector
+      # reddens the production run (measured: 3 stale rows) instead of going
+      # quietly green, which is what keeps this out of the double-green family
+      # `check:self-test-wired` names.
+      # Invoked as `node` rather than through a `pnpm check:*` alias: see the
+      # GATE INVOCATION IDIOM note at the top of this file.
+      # Scans ~5k files under packages/** + examples/**, no spawns; ~2s.
+      - name: No new private comment-strippers (all route through js-comment-mask)
+        run: |
+          node scripts/check-comment-mask-adoption.mjs --self-test
+          node scripts/check-comment-mask-adoption.mjs
+
       # The bash-3.2 floor, over every shell file the repo ships (#12221).
       # `/usr/bin/env bash` is bash 3.2.57 on macOS -- Apple ships no bash 4+,
       # for licensing reasons -- and THIS RUNNER IS BASH 5, where every construct