I started noticing this false positive when I had the Browser MCP extension installed:

Apparently this injects a custom browser-mcp-container element which has its own HTML element. The browser's parser prevents adding multiple HTML elements to the page, and so axe seems to assume that when it queries the html element the only thing it could ever possibly match is the root. That's not correct. Instead of selecting the HTML element html-has-lang should select :root.

I don't think this is just a shadow DOM issue. I suspect you can also document.createElement('html') and then append that to the DOM.