fix(validate): trailing comments read as requests; waivers covered whole files

[pitimon]

Summary

Closes items 4 and 3 of #110, in the order the issue set: both protect the control itself rather than extending its reach.

• Item 4 — a URL in a trailing comment counted as a request. const x = 5; // see https://github.com/nodejs/node/issues/123 failed the check. Reference links after code are common, and the issue named this the likeliest source of pressure to switch the whole thing off. Comments are now positional ranges scanned with string state tracked — the token being looked for (//) is the one every URL contains, so fetch("https://x") must not read as a comment.
• Item 3 — link_from/data_from waived a whole file, permanently. Waivers are now pinned to the URL literal ({"file": ..., "url": ...}). A bare filename is rejected; a pin matching nothing is reported as stale.

What this catches that main does not

The scenario #110 describes, which is the shape of #100: adding an owner-avatar <img src> to SkillDetailPanel.jsx — a plausible "show skill authors" change — to a file that already holds a github.com link waiver and already interpolates owner names. On main it passes silently. Here it is a finding, and closing it is a visible diff in outbound-hosts.json that a reviewer has to approve.

Two defects surfaced while doing it

• The request map was keyed by file, so a second request to the same host from one file overwrote the first — only the last line was ever reported. That is why src/lib/skills-manager.js:371 was invisible; the real count is 9 records, not 8.
• A pre-existing over-exemption in the dangerous direction: /* note */ fetch("https://x") starts with /*, so COMMENT_LINE_RE exempted the whole line, live call included. That regex now covers only the JSDoc * continuation line.

Design note — why line-local

No block-comment state is carried across lines. A regex literal like /[/*]/ opens a block comment as far as this scanner is concerned; carrying that forward would silence the rest of the file, which is a miss. Confined to one line the same mistake costs at most one false finding — visible and fixable. There is a test for exactly this.

Test plan

• ci:local exit 0 — 891 root tests (+8), 256 dashboard
• validate:outbound green: 24 declared hosts
• Behaviour-preserving on the real tree: old and new scanners return the identical 78 mention/request entries — nothing lost, nothing gained. Differences appear only against fixtures.
• checkOutbound was 113 lines (over the 50 rule); split into checkRequestPermission (45) and checkReadmeTable (12), leaving it at 41
• New tests cover: trailing comment is a mention · // inside a string is not a comment · code after a closed block comment is still a request · an unterminated /* stops at its own line · a waiver covers the URL not the file · every request per file is reported · a stale pin is reported · a bare filename is rejected

Not in this PR

#110 items 1, 2, 5, 6, 7 remain open and are unchanged.