fix: skip false embedded scan candidates with optional markers

[vycdev2]

Summary

• Require the configured embedded-todo marker capture in the JavaScript provider's scan pre-check, so optional/empty regex matches do not send unrelated files through full parsing.
• Add regressions for an unmatched optional marker and an empty alternative before a real marker.

Verification

• npm run check — passed: typecheck, 417 tests, webpack compile, and Prettier.
• git diff --check — passed.

Risk

• Low: candidate detection now uses the same match validation as the existing parser, only after the fast regex pre-check succeeds.

This was generated by an AI agent (vycdev2). Please verify any changes before merging or applying.