docs(src): fix CommentChecker findings across src/ — 1,032 → 5 (all false positives)

Comment/XML-doc changes only, no code logic:
- strip project-tracking references (WP*, P*-*, row-NN, #NN, Task N) from
  comments, keeping the explanatory rationale
- add missing summaries, <param>, <returns>, <typeparam> and <inheritdoc/>
- replace misused <inheritdoc/> with real docs; where <inheritdoc/> was
  combined with useful remarks, move the rationale into // comments
- drop stale replicationActor <param> on DeploymentManagerActor ctor

Remaining 5 are false positives (CWE-1236 x2, failures-1, year-0001, M365).
Build 0 errors / 0 warnings.

src/ZB.MOM.WW.ScadaBridge.Host/Program.cs

@@ -77,7 +77,7 @@ var configuration = new ConfigurationBuilder()
 // The expander MUST read the SAME store the running node will serve — SecretsRegistration.
 // UsesCentralSharedStore is the single predicate deciding that, shared with the runtime
 // registration in AddScadaBridgeSecrets, so the two can never disagree. On a Central node with
-// Secrets:Store:Provider=SqlServer that is the SHARED SQL-Server store (Task 5): an expander left
+// Secrets:Store:Provider=SqlServer that is the SHARED SQL-Server store: an expander left
 // on SQLite there would resolve pre-host ${secret:} references (e.g. ScadaBridge:Security:
 // JwtSigningKey) from a store the node does not actually serve, so a value rotated through the
 // shared store would never reach the pre-host config, and two central nodes could disagree on
@@ -312,7 +312,7 @@ try
         // for ScriptArtifactsChanged. The Transport bundle importer publishes
         // post-commit; the Inbound API's ScriptArtifactChangeSubscriber (a hosted
         // service registered by AddInboundAPI below) consumes ApiMethod notifications
-        // and invalidates the compiled-handler cache (wired in plan R2-06 T1; the
+        // and invalidates the compiled-handler cache (the
         // per-request revision check remains the correctness fallback).
         // SharedScript/Template notifications currently have NO consumer — nothing at
         // central caches compiled artifacts of those kinds. Central-only.
@@ -345,7 +345,7 @@ try
         // the KpiHistoryRecorderActor cluster singleton (started in
         // AkkaHostedService). Observability/best-effort: NOT readiness-gated.
         builder.Services.AddKpiHistory(builder.Configuration);
-        // P5-5 (arch-review Low): cross-validates the rate-fold interval triple
+        // Cross-validates the rate-fold interval triple
         // (KpiHistoryOptions.SampleInterval, NotificationOutboxOptions.DeliveredKpiWindow,
         // SiteCallAuditOptions.KpiInterval) at boot. Rides KpiHistoryOptions' existing
         // ValidateOnStart trigger set by AddKpiHistory above.
@@ -388,7 +388,7 @@ try
         // Local SQLite store by default. With Secrets:Store:Provider=SqlServer this central node's
         // store becomes the SHARED SQL-Server database instead — no hub, no follower sweep, just
         // both central nodes reading and writing the same rows, so a clustered pair can never ship
-        // sites a drifted secret set (Task 5). The Layer-A pre-host expander above resolves this
+        // sites a drifted secret set. The Layer-A pre-host expander above resolves this
         // same predicate (SecretsRegistration.UsesCentralSharedStore) so it always reads the store
         // this node actually serves. See SecretsRegistration for why the SQL gate exists (eager
         // options validation) and why the connection string can never itself be a ${secret:}
@@ -569,7 +569,7 @@ try
         builder.Services.AddSingleton<Akka.Actor.ActorSystem>(sp =>
             sp.GetRequiredService<AkkaHostedService>().GetOrCreateActorSystem());
 
-        // Simultaneous-cold-start split-brain guard (Gitea #33, dark switch
+        // Simultaneous-cold-start split-brain guard (dark switch
         // ScadaBridge:Cluster:BootstrapGuard:Enabled, default off). Registered AFTER the
         // AkkaHostedService/ActorSystem bridge so its StartAsync resolves the system the main path
         // built; when the guard is off it no-ops (Akka auto-joined from config seeds), so registering
@@ -727,7 +727,7 @@ try
         // connection to the right pipeline by listener/protocol.
         app.MapGrpcService<ZB.MOM.WW.ScadaBridge.Communication.Grpc.CentralControlGrpcService>();
 
-        // The pull-only secrets hub that used to be mapped here (scadaproj#3) is retired — Task 11.
+        // The pull-only secrets hub that used to be mapped here is retired.
         // Sites receive secrets exclusively via Deploy Artifacts; there is no hub endpoint to map
         // on central and nothing left for a site to sweep. See SecretsRegistration.