fix: round 8 of the release review of 6.3.0, for 6.3.1

Round 8 (0f400d3..29b4ac9, BLOCK: 1 BLOCKER, 12 MAJOR, 1 MINOR). Each fix
began with a test that failed on 29b4ac9 (13 tests, all red there); suite
2221 (2219/0/2).

- BLOCKER: a backticked check whose trailing comment holds a quote, $,
  backtick or backslash is refused, not dropped. The comment was never
  screened, while the executor hands the Verify span as written to red
  proof, the test lock and the done line inside --cmd "...", where a $(...)
  runs and a quote ends the argument. trekplan's text and the reviewer's
  NOT RUN table say so.
- A span that is only a comment is not-a-command, not a placeholder. The
  dropComment text says the allowlist still refuses a word with a # in it.
- The criteria runner, comparison-gate and end-state-gate use isMain: they
  did nothing and exited 0 under a symlinked path. The test now refuses any
  process.argv[1] comparison outside lib/util/is-main.mjs.
- Files: in a field with backticked paths, a plain word counts only before
  the entry's description (a dash, or a colon after the path); a name with
  no slash only first in its entry or after and/or/+/&. "mocks
  fs.readFileSync", "runs on Node.js 22.x" or "no change to package.json"
  no longer make a tests-only step look like it builds something.
  Lowercase makefile, rakefile and justfile are build files. Measured on the
  520 Files: fields in 48 plans of the marketplace and the test repo:
  3 fields read differently (two notes no longer read as files, one
  duplicate name dropped), tests-only changed in 0.
- The test lock compares --cmd without its trailing comment, and the test
  lock and the done line read a stop with stoppedBy, the one reading.
  red-proof drops its second reading, spawnError.
- release-check reads a relative --review in --repo or, when only that one
  exists, from the current directory as 6.3.0 did; two different files are
  exit 2, never guessed. The runbook says so.
- One trailing-json reader: a closing fence may be longer than three
  backticks, in the block reader and the verdict gate alike, and the review
  validator and the synthesis digest use it, so three backticks inside a
  JSON string no longer hide a BLOCKER from the remediation-step check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/review/findings-schema.mjs

@@ -42,8 +42,12 @@ export const FINDING_REQUIRED_FIELDS = Object.freeze([
 // gate's reader: a JSON string cannot hold a line break, so three backticks
 // inside one ("a fenced ```bash block") never end the block. Ending it at the
 // first triple backtick anywhere made fill-finding-ids exit 2 (release review
-// of 6.3.0, found while writing round 7's review.md; present in 6.2.0).
-const JSON_FENCE_GLOBAL = /^[ \t]*```json[ \t]*\r?\n([\s\S]*?)^[ \t]*```[ \t]*\r?$/gim;
+// of 6.3.0, found while writing round 7's review.md; present in 6.2.0). As in
+// Markdown, the closing fence may be longer than three backticks (round 8);
+// three backticks after text on the same line are no fence, here or in the gate.
+// One reader for every trailing json block: the review validator and the
+// synthesis digest import it.
+const JSON_FENCE_GLOBAL = /^[ \t]*```json[ \t]*\r?\n([\s\S]*?)^[ \t]*`{3,}[ \t]*\r?$/gim;
 
 /**
  * Extract the inner body of the LAST fenced `json` block in `text`.

lib/review/verdict-gate.mjs

@@ -118,7 +118,9 @@ function atLeastVersion(v, major, minor) {
   return Boolean(m) && (Number(m[1]) > major || (Number(m[1]) === major && Number(m[2]) >= minor));
 }
 
-const FENCE_RE = /^```[ \t]*([A-Za-z0-9_+-]*)[^\n]*\n[\s\S]*?^```[ \t]*$/gm;
+// A fence as lib/review/findings-schema.mjs reads one: on a line of its own,
+// indented or not, and a closing fence of three backticks or more (round 8).
+const FENCE_RE = /^[ \t]*```[ \t]*([A-Za-z0-9_+-]*)[^\n]*\n[\s\S]*?^[ \t]*`{3,}[ \t]*$/gm;
 
 /** Language tag of the LAST fenced block in `body` (lower-cased), '' for none, null when no fence. */
 function lastFenceLanguage(body) {