fix: address Copilot review round 4

The comment stripper had a real hole: the line-comment regex was anchored, so it
only removed `//` at the start of a line and a call disabled after code —
`const disabled = true; // configure({ asyncUtilTimeout: 1000 });` — survived it
and the guard passed with no effective configuration. Replaced with a scanner,
because a regex gets this wrong in both directions: it has to strip a comment
that follows code, and it must NOT treat the `//` inside a string literal as one,
which would silently truncate any line holding a URL. Quote tracking (with
escapes) is the only way to have both. Three regression tests.

Two documentation claims were also wrong. The guard header and quality-gate.md
cited #2278 and #2250 as instances of a budget nobody chose; they were not —
#2278 was a missing condition wait around a geometry read and #2250 a real race
in a test's own timing, both fixed by making the test wait for the right thing.
Presenting a race fix as evidence for a larger ceiling argues against #1596,
which this guard exists to uphold. Only the budget and poll-ceiling cases are
cited now, and both files say explicitly why those two are excluded.

And browser-timeouts.mjs overstated its own behavior twice: `bestEffort` can
spend its full budget on an otherwise passing smoke precisely because its expiry
is caught, and raising any budget does delay the report when the thing waited on
never arrives. The diagnostics improve the eventual message; they do not make
the wait shorter. Both now stated plainly, so the header is something to weigh a
change against rather than a reassurance.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PsmUAZ6aLUAFqenjJKSSRp
Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/verify-test-timeouts.test.mjs

@@ -222,6 +222,34 @@ configure({ asyncUtilTimeout: 1_000 });`;
   assert.deepEqual(checkAsyncUtilSource(source, "storybook/test"), []);
 });
 
+test("a call disabled in a TRAILING line comment does not satisfy the check", () => {
+  // The anchored regex this replaced only stripped `//` at the start of a line,
+  // so a call commented out after code survived and the guard passed with no
+  // effective configuration (Copilot).
+  const source = `import { configure } from "storybook/test";
+const disabled = true; // configure({ asyncUtilTimeout: 1000 });`;
+  assert.deepEqual(checkAsyncUtilSource(source, "storybook/test"), [
+    "does not call configure()",
+  ]);
+});
+
+test("a // inside a string literal is not treated as a comment", () => {
+  // The failure mode in the other direction: an unanchored strip would truncate
+  // any line holding a URL, which could remove the real call.
+  const source = `import { configure } from "storybook/test";
+const docs = "https://testing-library.com/docs";
+configure({ asyncUtilTimeout: 1000 });`;
+  assert.deepEqual(checkAsyncUtilSource(source, "storybook/test"), []);
+  assert.match(stripComments(source), /https:\/\/testing-library/);
+});
+
+test("stripComments handles escapes and mid-line block comments", () => {
+  assert.equal(stripComments("a /* x */ b"), "a  b");
+  // A backslash-escaped quote must not close the string early, or everything
+  // after it would be scanned as code.
+  assert.match(stripComments('const s = "a\\" // b";\nkeep'), /keep/);
+});
+
 test("stripComments leaves executable code alone", () => {
   const source = `/** header */
 import { configure } from "storybook/test"; // trailing