[bewaterhere-coder]

Summary

• Extract the existing bounded C# and Lua comment masker into a shared Core helper.
• Reuse it in both Semantic Rule evaluation and generic professional guidance previews.
• Keep .asmdef files as JSON rather than applying C# comment rules to JSON string values.
• Add Unity and Skynet regression tests where comment markers inside strings must not hide later source signals.

Why

The C# and Lua string-aware fix in Semantic Rules left a duplicate regex in professional_preview. That meant the generic Core preview path still produced false negatives for strings containing https:// or -- before a real code signal. Maintaining two scanners also risked future behavior drift.

Boundaries

• Core-only shared source preprocessing; no engine-specific check logic added.
• The scanner remains bounded and is not a full language parser.
• .asmdef is treated as JSON, not C# source.
• Findings remain advisory and non-blocking.
• No public API or schema version change.

Validation

Python 3.10–3.13, MCP stdio E2E and Sample Project Advisory.