Analyse: Rechtstexte Fix 1 (Kommentare nicht veroeffentlichen, Abschalt-Wortlaut, TOM)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

runner/src/analytics-inject.js

@@ -10,6 +10,9 @@ const TEMPLATE_URL = new URL('./templates/datenschutz-analyse.html', import.meta
 
 const esc = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;');
 
+// Interne Kommentare dürfen nie veröffentlicht werden.
+export const stripComments = (t) => t.replace(/<!--[\s\S]*?-->\s*?\n?/g, '');
+
 export const isValidBase = (b) => typeof b === 'string' && /^https:\/\/[^\s"'<>]+\/$/.test(b);
 
 export function scriptTag(analytics, baseUrl) {
@@ -78,7 +81,7 @@ export async function injectAnalytics(dir, analytics, { baseUrl, onLine, fs = no
   if (!isValidBase(baseUrl)) throw new Error('Analyse: ungültige öffentliche Basis-URL');
   const tag = scriptTag(analytics, baseUrl);
   const p = analytics.privacy || {};
-  const template = await fs.readFile(TEMPLATE_URL, 'utf8');
+  const template = stripComments(await fs.readFile(TEMPLATE_URL, 'utf8'));
   const withAddr = p.address ? template.replace(/\{\{#address\}\}|\{\{\/address\}\}/g, '') : template.replace(/\{\{#address\}\}[\s\S]*?\{\{\/address\}\}/g, '');
   const page = withAddr.replace(/\{\{(company|address|email)\}\}/g, (_, k) => esc(p[k] ?? ''));
   await fs.writeFile(join(dir, PAGE), page, 'utf8');