fix(ci): ignore comments after workflow with keys

[Chris0Jeky]

Summary

• strip trailing YAML comments before matching a sibling with: key
• add a regression proving with: # comment remains a block mapping
• preserve the fail-closed rejection for a real inline with scalar

Verification

ode --test scripts/ci/release-cache-contract.test.mjs — 29 passed

• git diff --check

This is a CI-09 scanner-only repair; hosted CI on the exact PR head remains the merge gate.

Closes #2450
Refs #2333

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Chris0Jeky]

The connector usage-limit notice is informational, not a review finding. This PR is being checked through the independent coordinator review path; no code action is requested from this notice.

[Chris0Jeky]

Review (agent half of the ADR-0066 gate; Codex credits exhausted, SC-9): one fresh-context reviewer confirmed stripYamlComment is quote-aware and requires a whitespace-preceded unquoted # (YAML's own rule), so a real inline with: scalar cannot slip past the fail-closed check; the regression fixture discriminates by construction; no real workflow currently contains 'with: #', so this is defensive. Verdict SHIP. LOWs declined (the inline fixture is not valid YAML but the checker is a line scanner; the with-input loop's naive comment strip is pre-existing and fail-closed). CI-control region: parked for the maintainer's review per ADR-0066 / SC-10 — adding to that list.