fix(xtask): ignore block comments when checking core lint attributes #2

Goal

Make check:boundary find the core crates' forbid attribute only in real code, so a commented-out attribute plus an allow cannot pass.

Context

Review nit on #1 (crates/xtask-core/src/boundary.rs:199): forbidden_lints skips // lines but not /* */ block comments, so /* #![forbid(...)] */ with #![allow(clippy::disallowed_methods)] passes the check. Not blocking for the bootstrap; tracked here.

Acceptance criteria

• The check parses crate-root attributes from Rust tokens (or strips block comments, including nested ones) before matching.
• A test plants the block-comment evasion and the check fails.

Refs: RFC-36/6