fix: Only check for TODO/mock in comments, not strings

The previous check flagged TODO/mock anywhere in Python scripts,
including legitimate uses in:
- String literals (error messages, docstrings)
- Code that checks for TODOs (like code review scripts)

Updated all three checks to only flag patterns in actual comment
lines (starting with #):
- TODO detection: ^\s*#.*\bTODO\b
- Stub detection: ^\s*#.*(stub patterns)
- Mock detection: ^\s*#.*\bmock\b.*\bimplementation\b

This eliminates false positives while preserving detection of
incomplete work marked in comments.

Author: rand

.github/workflows/validate-resources.yml

@@ -155,7 +155,8 @@ jobs:
           found=0
 
           while IFS= read -r script; do
-            if grep -qi '\bTODO\b' "$script"; then
+            # Only flag TODO in actual comments (starting with #), not in strings or code
+            if grep -qiE '^\s*#.*\bTODO\b' "$script"; then
               echo "⚠️ $script: Contains TODO comments"
               ((found++))
             fi
@@ -164,7 +165,8 @@ jobs:
               echo "⚠️ $script: Contains stub implementation references"
               ((found++))
             fi
-            if grep -qiE '\bmock\b.*\bimplementation\b' "$script"; then
+            # Only flag mock implementation in comments
+            if grep -qiE '^\s*#.*\bmock\b.*\bimplementation\b' "$script"; then
               echo "⚠️ $script: May contain mock implementation"
               ((found++))
             fi