P2 false positives on benign standalone header comments (complete, top-of-file, danger-free) #677

Problem

SkillSpector reports P2 prompt-injection on benign standalone header
comments: license headers (<!-- Copyright (c) 2026 Example Corp. SPDX-License-Identifier: Apache-2.0 ... -->), get-started pointers,
and dependency declarations in complete top-of-file comments that
carry no override or exfiltration signal. These are distinct from
#37's reported spans (matches running past --> into <style>
blocks), which come from the unbounded .*? in the P2 comment
regex and are out of scope here.

Proposed scope

Exempt a P2 comment match only when it is one complete comment near
the top of the file (or directly after closed frontmatter), at most
300 characters, danger-free, and every fragment fully matches an
anchored license-line form or a per-key metadata grammar. Spanning,
partial, and multi-comment matches keep firing (fail-closed).

Acceptance

• The three repro cases above (plus reference-comment form) scan
  clean; the reviewer's space-joined and imperative-value payloads
  still fire, pinned as regressions.
• Creates false positives on pure text-based content #37 stays open for the regex root cause (Fix P2 HTML comment boundary matching #452 or a successor);
  this issue closes with the carve-out.