fix: ignore comment-only placeholder markers

[bxvtr]

Summary

• Fresh clean-room acceptance stopped before Terraform mutation because a populated terraform.tfvars still matched the committed example comment containing sed -e 's/<.*$//'.
• The shared detector now treats only active non-comment lines as unresolved placeholders; check-cloud-shell-readiness uses the same helper.
• Active placeholders such as oci_region = "<oci-region>" remain rejected. Regression coverage covers HCL/YAML rejection and comment-only acceptance.

Test plan

• Unit contracts for placeholder detection
• Required PR CI on the new head
• Live operator acceptance is not part of this change; no infrastructure was mutated during implementation or review.