[bewaterhere-coder]

Summary

• Make C# and Lua comment filtering aware of quoted strings and Lua long-bracket strings.
• Preserve source text inside strings while masking actual line/block comments.
• Add regression tests for https:// in C# strings and -- in Lua strings so later code on the same line remains visible.

Why

The previous comment-removal regex treated // and -- inside string literals as comment starts. This could erase real code evidence later on the same line and produce false review_needed results.

Boundaries

• This remains a bounded literal scan, not a full C# or Lua parser.
• No claim of control-flow or runtime correctness is added.
• Existing non-blocking advisory semantics are unchanged.
• No public API or schema version change.

Validation

Python 3.10–3.13, MCP stdio E2E and Sample Project Advisory.