Transitive dependency scan includes backend references inside XML comments #305

Command that triggered the bug

apiops extract

Expected behavior

The transitive dependency scan should ignore backend references inside XML comments. Since the set-backend-service element in the operation policy is commented out, backend should not be discovered as a dependency or extracted unless explicitly included in the filter.

Actual behavior

The extract added backendInformation.json, even though backend is not in the backends list in configuration/extractor.config.yaml. The only backend reference in the selected API artifacts is inside an XML comment in the operation policy.

apiops CLI version

1.0.4

Environment details

1. Filter extraction to an API that has an operation policy with backend reference commented out

2. Leave the commented backend out of the backends filter list.

3. Run apiops extract with transitive dependency resolution enabled (the default).

4. Observe that backendInformation.json is generated.

APIOps CLI: 1.0.4 (pinned in package-lock.json)
The transitive resolver appears to regex-scan policy text for set-backend-service backend-id attributes without stripping XML comments first.

CI/CD environment

None

Is this bug blocking you?

None