feat(sdk): strip HTML comment regions before UAT item scan (#3184)

Cycle 7 of ~15: adds HTML-comment stripping pass. Operator
notes inside <!-- ... --> no longer pollute the item roster.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

sdk/src/query/phase-uat-passed.test.ts

@@ -163,6 +163,40 @@ expected: blah
 result: pass
 \`\`\`
 
+### 1. Real item
+expected: real
+result: pass
+`;
+      await writeFile(join(phaseDir, '05-HUMAN-UAT.md'), content);
+
+      const result = await isPhaseUatPassed(localTmp, '5');
+      expect(result.items.length).toBe(1);
+      expect(result.items[0].name).toBe('Real item');
+      expect(result.passed).toBe(true);
+    } finally {
+      await rm(localTmp, { recursive: true, force: true });
+    }
+  });
+
+  it('ignores ### item content inside HTML comments', async () => {
+    const localTmp = await mkdtemp(join(tmpdir(), 'gsd-uat-c7-'));
+    try {
+      const phaseDir = join(localTmp, '.planning', 'phases', '05-html-comment-injection');
+      await mkdir(phaseDir, { recursive: true });
+      const content = `---
+status: complete
+phase: 5
+source: roadmap
+started: 2026-05-18T00:00:00Z
+updated: 2026-05-18T00:00:00Z
+---
+
+<!--
+### 1. Commented-out item
+expected: blah
+result: pass
+-->
+
 ### 1. Real item
 expected: real
 result: pass

sdk/src/query/phase-uat-passed.ts

@@ -45,6 +45,8 @@ function stripMarkdownInjection(content: string): string {
   let s = content.replace(/^---\r?\n[\s\S]*?\r?\n---/m, '');
   // Pass 2: strip fenced code blocks (``` ... ```)
   s = s.replace(/```[\s\S]*?```/g, '');
+  // Pass 3: strip HTML comment regions (<!-- ... -->)
+  s = s.replace(/<!--[\s\S]*?-->/g, '');
   return s;
 }