gate-7: consolidate its private stripper into source_scope.php_mask (unblocked by #438)

[rubenvdlinde]

Follow-up unblocked by #438 (52146a9).

Why it was deferred, and why that reason is gone

gate-7's checker carries its own comment/string stripper, check_no_admin_idor._strip_strings_and_comments. Consolidating it into source_scope.php_mask was previously incorrect, because the private copy handled heredocs/nowdocs and php_mask did not — routing gate-7 into the shared helper would have made it parse a <<<SQL body as code.

#438 moved that capability into php_mask (it had to: #437 had added heredoc handling to gate-50's private copy, and deleting that copy without relocating the capability would have silently regressed gates 5/8/50/59/64). So the objection no longer holds.

Why this needs its own change rather than riding on #438

gate-7 measures 64 findings across the six-repo sample. It is the gate that once reported 0 findings across all 18 apps while 167 real IDORs sat behind it, so a silent shift in what it sees is the most expensive possible outcome of a refactor. It needs its own before/after, not a line in someone else's.

What "done" looks like

• Before/after finding sets — not counts — across at least six repos. Two gates measured 2 → 2 during this programme with completely different sets, a false positive leaving as a false negative arrived.
• A two-directional control on a reconstructed pre-fix tree, since a zero delta alone is a quiet instrument rather than a measurement.
• Acceptance arms with a revert test, controls labelled as controls. Note git checkout -- <file> is not a revert once committed — it restores from HEAD.
• Timing at three input sizes. fix(gates): harden markup_mask's delimiter scope, then close the string-literal-as-evidence axis in 16 gates (#424) #438 found three quadratic scans this way; none was exponential, so py/redos flagged none of them, and one extrapolated to ~3 hours on a 1 MB file. A gate that times out is a gate that did not run.

Still deliberately not in scope

gate-7's string-literal variant. Blanking literals in a 2,800-line checker whose known failure mode is over-reporting trades a measured false negative for an unmeasured wave of false positives, on a gate the fleet has already learned to distrust. Reported rather than smuggled in — see #424.