fix(sanitize,okf,active_content): three quadratic patterns, two on the input path

The generalised sweep found what 0.3.2's hand-written rows missed. All three are
the documented class -- a run in front of a required literal that never arrives,
so every start position rescans the tail -- and all three are worse than the
0.3.3 findings, because `sanitize`, `neutralize`, `scan_active_content` and the
okf link graph apply NO input cap. `scan_lexicon`/`scan_output` are the only
entry points that do, so there is no ceiling to extrapolate to.

  sanitize._HTML_COMMENT_RE   `<!--`*100_000        20.1s, exponent 1.96-2.14
  active_content.URL_IN_TEXT_RE  `<a `+`A`*100_000  12.99s / 14.9s, exponent ~2.0
  okf._MD_LINK_RE             `[`*100_000            7.1s, exponent 1.99-2.05

Each fix is the one the pattern's own shape allows, not a copied choice:

  - The comment stripper drops the regex for `str.find`. Excluding `<` would lose
    every comment containing markup; bounding the run would be a carrier bypass
    of the exact construct the stripper exists to remove.
  - `URL_IN_TEXT_RE` bounds its scheme run to an RFC 3986 scheme (`{0,63}`).
    Bounding is safe *here* only because it is a defanger inside a tag already
    flagged `active:raw-html`. A lookbehind was measured too and rejected: it
    drops `-http://evil.com`, a one-character evasion. Bounded: 0.185s at 1M.
  - `_MD_LINK_RE` excludes `[`, matching `active_content.MD_LINK_RE` exactly,
    including the nested-label trade already documented there.

`sanitize` claimed "no catastrophic backtracking" in a comment; that claim was
wrong in the same way `output`'s was before 0.3.2, and is corrected in place.

676 tests (+10), coverage 128/128 + 6/6 gaps, sweep clean across 150 patterns.
The okf destination run gets no row: `[^)\s]+` cannot fail, so a row for it
could never go red.

tests/test_sanitize.py

@@ -4,6 +4,8 @@ Core invariants (BRIEF §9): clean input returns byte-identical with an all-zero
 report; the sanitizer only ever *removes* — its output is always a subsequence
 of the input.
 """
+import time
+
 from llm_ingestion_guard.sanitize import sanitize
 from llm_ingestion_guard.report import Severity, Source
 
@@ -75,3 +77,42 @@ def test_data_uri_does_not_match_inside_a_word():
 def test_output_source_is_respected():
     result = sanitize("x​y", source=Source.OUTPUT)
     assert all(f.source is Source.OUTPUT for f in result.report.findings)
+
+
+# --- self-safety (OWASP LLM10): ReDoS on the comment stripper ----------------
+# `sanitize` is step 1 of `prepare_input` -- the first thing every ingested
+# document hits -- and unlike `scan_lexicon`/`scan_output` it applies NO input
+# cap, so a quadratic run here has no ceiling at all. `<!--.*?-->` is a lazy run
+# in front of a REQUIRED literal: crafted input that repeats the opener and never
+# supplies `-->` makes every start position rescan the tail. Measured 20.1s at
+# 100_000 chars, exponent 1.96-2.14 over four doublings. Found by
+# docs/redos-sweep.py once it was generalised past the lexicon table.
+_REDOS_N = 100_000
+
+
+def test_crafted_comment_payload_stays_bounded():
+    payload = ("<!--" * (_REDOS_N // 4 + 1))[:_REDOS_N]
+    start = time.monotonic()
+    sanitize(payload)
+    assert time.monotonic() - start < 2.0
+
+
+def test_legitimate_comment_heavy_document_is_far_under_the_bound():
+    # The bound above only has signal if ordinary comment-dense content is
+    # nowhere near it: this is the same size, 100% closed comments.
+    unit = "<!-- a note -->"
+    payload = (unit * (_REDOS_N // len(unit) + 1))[:_REDOS_N]
+    start = time.monotonic()
+    sanitize(payload)
+    assert time.monotonic() - start < 0.5
+
+
+def test_comment_stripping_survives_the_redos_fix():
+    # Recall parity for every comment shape the lazy regex used to handle:
+    # nested markup, newlines (the pattern was DOTALL), and an unterminated
+    # comment, which must be left alone rather than swallowed to end-of-input.
+    assert sanitize("a <!-- <b>x</b> --> z").text == "a  z"
+    assert sanitize("a <!-- one\ntwo --> z").text == "a  z"
+    assert sanitize("a <!-- x --> b <!-- y --> c").text == "a  b  c"
+    assert sanitize("a <!-- never closed").text == "a <!-- never closed"
+    assert sanitize("a --> b").text == "a --> b"