feat(detection): Phase B recall hardening — fix comment-stripping + add coverage (recall 0.42→0.86)

[rennf93]

Stacks on #34 (base = feat/attack-campaign). Fast-forward, no conflict. Retarget to master after #33/#34 land.

Remediates the gaps the attack-sim harness + campaign measured. Pure recall pass — false positives held flat (the SELECT-in-prose FP is deferred to a separate precision pass).

Result (harness)

• detection_rate: 0.421 → 0.857
• fp_rate: 0.125 → 0.125 (ratchet-enforced; the recall additions did not worsen false positives)
• Per class: sqli 0.98, nosql 0.92, ssrf/xss/path 0.95, ldap 0.97, cmd 0.86, template 0.45.

What changed (each async + hand-mirrored to guard_core/sync/, TDD with a detection test + a benign near-miss)

1. Comment-stripping fix — ContentPreprocessor no longer merges SELECT/**/FROM→SELECTFROM; preserves MySQL /*!…*/ conditional comments; word-glued comment injection (SEL/**/ECT) is now a detection signal. Quote-flanked comments still strip correctly (1'/**/OR→1' OR).
2. SQLi — DDL/stacked (DROP/TRUNCATE/ALTER, INSERT/UPDATE/DELETE), ORDER BY enumeration, and a '1'='1 tautology pattern (also catches the pre-existing boolean-SQLi miss).
3. NoSQL — JSON-quoted operators ("$gt", "$ne", …).
4. SSTI — ERB <%= %> and expression-bearing ${…} (method call / @class@ / arithmetic).
5. cmd-injection — bare-separator + reverse-shell (netcat/-e, /dev/tcp) patterns; fullwidth separators (；｜＆) normalized.
6. New categories — proto_pollution and code_injection, fully registered (contexts, ALL_DETECTION_CATEGORIES, CATEGORY_CONTEXT_MAP, catalog tests incl. the sync mirror).
7. Ratchet baseline re-recorded; long pattern/test lines wrapped to satisfy ruff check E501/I001.

Verification

340 tests pass (incl. the catalog test + sync mirror + the attack-sim ratchet). ruff check + ruff format --check clean; vulture clean. Patterns are ReDoS-conscious (no nested quantifiers); async/sync handler pattern lists are byte-identical.

Deferred (noted, not in this PR)

• template recall (0.45) — encoded mutation variants of ${…}/{{…}} still evade.
• #-bearing OGNL (${#ctx…}) is truncated by the # SQL-line-comment stripper — a preprocessor/precision issue.
• The prose_sql_keywords false positive (0.67) — the dedicated precision pass (B3).

Test-only + detection-code edits; no API/route changes. Pre-existing sync-mirror --check CI may be red, unrelated.