Runner: Analyse-Einsetzen ignoriert Kommentare/Skripte (Fix Runde 1)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

runner/src/validate.js

@@ -1,11 +1,10 @@
 // Strikte Eingabeprüfung für Runner-Jobs.
+import { RE_SITE_KEY, RE_COLOR } from './analytics-inject.js';
 const RE_SUB = /^[a-z0-9-]{1,63}$/;
 const RE_REPO = /^[\w.-]+\/[\w.-]+$/;
 const RE_SHA = /^[0-9a-f]{7,40}$/;
 const RE_BRANCH = /^[\w./-]{1,100}$/;
 const RE_ENV = /^[A-Z_][A-Z0-9_]*$/;
-const RE_SITE_KEY = /^[a-z0-9]{16,40}$/;
-const RE_COLOR = /^#[0-9a-f]{6}$/;
 const MODES = ['auto', 'build', 'dev'];
 
 export const isValidRunId = (s) => typeof s === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s);
@@ -58,10 +57,10 @@ export function validateJob(body) {
     const privacy = {};
     for (const [k, max] of [['company', 200], ['address', 300], ['email', 200]]) {
       const v = pr[k];
+      if (k === 'address' && (v === undefined || (typeof v === 'string' && !v.trim()))) { privacy[k] = ''; continue; }
       // eslint-disable-next-line no-control-regex
-      if (k === 'address' && (v === undefined || v === '')) { privacy[k] = ''; continue; }
       if (typeof v !== 'string' || !v.trim() || v.length > max || /[\x00-\x1f\x7f]/.test(v)) return { ok: false, error: `Ungültige Analyse-Datenschutzangabe: ${k}` };
-      privacy[k] = v;
+      privacy[k] = v.trim();
     }
     analytics = { siteKey: a.siteKey, color: a.color, privacy };
   }