scripts: the banned-entry gate must read directives, not comments

The v1.22.0 gate asserts the rendered grub.cfg has no live reference to
proxtui/proxdebug/nomodeset/Rescue Boot/memtest/fwsetup. It grepped the whole
file, so the template's own header — which documents exactly which stock entries
were dropped, and names them — tripped it. Caught on the first canary build:
fail-closed, no ISO produced, which is the behavior we want from a safety gate
that is wrong.

Strip comments before matching. A comment naming a removed entry is the point;
a directive using one is the bug.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE

scripts/iso/iso-repack.sh

@@ -154,9 +154,12 @@ if [[ "$BRAND" == "1" ]]; then
     N_SUB="$(grep -c '^[[:space:]]*submenu ' "$GCFG" || true)"
     [[ "$N_ENTRY" == "1" ]] || { echo "iso-repack: rendered grub.cfg has $N_ENTRY menuentries, want exactly 1" >&2; exit 14; }
     [[ "$N_SUB"   == "0" ]] || { echo "iso-repack: rendered grub.cfg has $N_SUB submenus, want 0" >&2; exit 14; }
+    # Strip comments first: the template's header EXPLAINS which stock entries were dropped, and
+    # naming them there must not trip the gate. What matters is that no live directive uses them.
+    LIVE="$(grep -v '^[[:space:]]*#' "$GCFG")"
     for banned in proxtui proxdebug nomodeset 'Rescue Boot' memtest fwsetup; do
-        if grep -q "$banned" "$GCFG"; then
-            echo "iso-repack: rendered grub.cfg still references '$banned'" >&2; exit 14
+        if grep -q "$banned" <<<"$LIVE"; then
+            echo "iso-repack: rendered grub.cfg still has a live reference to '$banned'" >&2; exit 14
         fi
     done
     grep -q "set theme=/boot/grub/felhomtheme/theme.txt" "$GCFG" \