docs(src): fix CommentChecker findings across src/ — 1,032 → 5 (all false positives)

Comment/XML-doc changes only, no code logic:
- strip project-tracking references (WP*, P*-*, row-NN, #NN, Task N) from
  comments, keeping the explanatory rationale
- add missing summaries, <param>, <returns>, <typeparam> and <inheritdoc/>
- replace misused <inheritdoc/> with real docs; where <inheritdoc/> was
  combined with useful remarks, move the rationale into // comments
- drop stale replicationActor <param> on DeploymentManagerActor ctor

Remaining 5 are false positives (CWE-1236 x2, failures-1, year-0001, M365).
Build 0 errors / 0 warnings.

src/ZB.MOM.WW.ScadaBridge.DataConnectionLayer/Adapters/MxGatewayDataConnection.cs

@@ -101,7 +101,7 @@ public class MxGatewayDataConnection
         // (no `secret:` prefix) passes through unchanged for back-compat.
         // The reference is parsed by the SAME parser central's SecretReferenceScanner uses to
         // decide which secret to ship (trimmed, case-insensitive prefix), so a padded or
-        // case-variant reference resolves exactly the name that was deployed (final review M3).
+        // case-variant reference resolves exactly the name that was deployed.
         var apiKey = cfg.ApiKey;
         if (SecretReferenceScanner.TryParseSecretReference(apiKey, out var secretName))
         {

src/ZB.MOM.WW.ScadaBridge.DataConnectionLayer/Adapters/OpcUaAlarmMapper.cs

@@ -19,7 +19,7 @@ public static class OpcUaAlarmMapper
     /// </summary>
     /// <remarks>
     /// <para>
-    /// <b>Why the routing identity is the binding string, not the event's name (Gitea #17).</b>
+    /// <b>Why the routing identity is the binding string, not the event's name.</b>
     /// Routing does <c>transition.SourceObjectReference.StartsWith(bindingRef)</c>, where the
     /// binding is a NodeId reference (the picker, CSV and config all store NodeIds). Deriving
     /// the routing identity from the event's <c>SourceName</c> — a plain name like the RawPath
@@ -39,7 +39,7 @@ public static class OpcUaAlarmMapper
     /// </para>
     /// </remarks>
     /// <param name="subscriptionSourceReference">The binding string this alarm feed was subscribed under (empty for the Server-object aggregate feed).</param>
-    /// <param name="sourceName">The event's <c>SourceName</c> field (the RawPath for OtOpcUa post-#473), or null/empty when unset.</param>
+    /// <param name="sourceName">The event's <c>SourceName</c> field (the RawPath for OtOpcUa), or null/empty when unset.</param>
     /// <param name="conditionName">The event's <c>ConditionName</c> field, or null/empty when unset.</param>
     /// <returns>The per-condition <c>SourceReference</c> key and the <c>SourceObjectReference</c> routing identity.</returns>
     public static (string SourceReference, string SourceObjectReference) BuildIdentity(

src/ZB.MOM.WW.ScadaBridge.DataConnectionLayer/Adapters/RealOpcUaClient.cs

@@ -29,7 +29,10 @@ public class RealOpcUaClient : IOpcUaClient
     /// </summary>
     private sealed class DataShard(Subscription subscription)
     {
+        /// <summary>The OPC UA subscription backing this shard.</summary>
         public Subscription Subscription { get; } = subscription;
+
+        /// <summary>The number of monitored items currently placed on this shard.</summary>
         public int ItemCount { get; set; }
     }
 
@@ -97,6 +100,10 @@ public class RealOpcUaClient : IOpcUaClient
     public event Action? ConnectionLost;
 
     /// <summary>Selects exactly the requested protection mode; protected discovery failures fail closed.</summary>
+    /// <param name="url">The discovery URL to query.</param>
+    /// <param name="requested">The security mode that must be matched exactly.</param>
+    /// <param name="discover">Delegate that returns the server's advertised endpoints.</param>
+    /// <returns>The endpoint matching the requested security mode.</returns>
     internal static EndpointDescription DiscoverEndpoint(string url, MessageSecurityMode requested,
         Func<EndpointDescriptionCollection> discover)
     {
@@ -266,6 +273,8 @@ public class RealOpcUaClient : IOpcUaClient
     /// A no-op when the advertised host/port is already reachable (so an opc-plc server that
     /// advertises its real container name is left untouched).
     /// </remarks>
+    /// <param name="endpoint">The discovered endpoint to rewrite in place; may be null.</param>
+    /// <param name="discoveryUrl">The reachable URL the operator configured.</param>
     internal static void RewriteEndpointHostForReachability(EndpointDescription? endpoint, string discoveryUrl)
     {
         if (endpoint is null || string.IsNullOrWhiteSpace(endpoint.EndpointUrl))
@@ -633,8 +642,7 @@ public class RealOpcUaClient : IOpcUaClient
                 // one) leaves every item created so far registered in _callbacks / _itemShard and
                 // counted against its shard's budget, with nothing to ever release them: the
                 // actor sees the throw as a whole-chunk fault and re-issues the SAME batch on its
-                // backoff timer, so each probe grew the bookkeeping again (arch-review 2026-08-19
-                // P2-4). Unwind before propagating.
+                // backoff timer, so each probe grew the bookkeeping again. Unwind before propagating.
                 UnwindCreatedItems(created);
                 throw;
             }
@@ -889,7 +897,7 @@ public class RealOpcUaClient : IOpcUaClient
         {
             if (e.NotificationValue is EventFieldList efl)
                 // sourceNodeId is the binding this feed was subscribed under; every
-                // transition on the feed is routed under it verbatim (see #17).
+                // transition on the feed is routed under it verbatim.
                 HandleAlarmEvent(handle, sourceNodeId, efl, onTransition);
         };
 
@@ -1171,8 +1179,8 @@ public class RealOpcUaClient : IOpcUaClient
 
         // Field layout (AlarmStateFields): [1]=SourceNode (NodeId), [2]=SourceName (string).
         // The routing identity is the binding this feed was subscribed under (not the
-        // event's name), so DataConnectionActor's NodeId-keyed routing matches — see #17
-        // and OpcUaAlarmMapper.BuildIdentity. SourceName seeds the readable per-condition
+        // event's name), so DataConnectionActor's NodeId-keyed routing matches — see
+        // OpcUaAlarmMapper.BuildIdentity. SourceName seeds the readable per-condition
         // key; fall back to the SourceNode NodeId string only when it is absent.
         var sourceName = fields[2].Value as string;
         if (string.IsNullOrEmpty(sourceName))