docs(comments): strip internal task/milestone/bundle bookkeeping from code comments

Remove project bookkeeping citations from shipped code comments across the
solution: hyphenated task IDs (WP-14, StoreAndForward-025), milestone/task/
issue refs (M3, Task 4, Audit Log #23, #21), Bundle X task-bundle labels,
and C/D/K/S/T phase labels.

Comment text only — no code logic, string/log literals, or XML-doc structure
changed. Genuine descriptions are preserved (only the citation is stripped),
and technical lookalikes are retained (UTF-8, SHA-256, T00:00:00, M365,
UTC-5, pre-C4/pre-C5 schema versions). Flagged by the new CommentChecker
TaskReferenceInComment / TrackingReferenceInComment checks plus targeted
grep passes; full solution builds clean, append-only guard tests pass.

src/ZB.MOM.WW.ScadaBridge.AuditLog/Central/CentralAuditWriter.cs

@@ -47,22 +47,22 @@ public sealed class CentralAuditWriter : ICentralAuditWriter
     private readonly INodeIdentityProvider? _nodeIdentity;
 
     /// <summary>
-    /// Bundle C (M5-T6) — the central direct-write path used by the
+    /// The central direct-write path used by the
     /// NotificationOutboxActor dispatch and the Inbound API middleware also
     /// needs to truncate + redact before the row hits MS SQL. The filter is
-    /// optional so the M4 test composition roots that don't pass one keep
+    /// optional so test composition roots that don't pass one keep
     /// working (they only ever write small payloads); production DI registers
     /// the real filter via <see cref="ServiceCollectionExtensions.AddAuditLog"/>.
-    /// M6 Bundle E (T8) — adds the optional
+    /// Adds the optional
     /// <see cref="ICentralAuditWriteFailureCounter"/> so a swallowed repository
     /// throw bumps the central health surface's
     /// <c>CentralAuditWriteFailures</c> counter. Defaults to a NoOp so test
     /// composition roots that don't wire the counter keep their current
-    /// behaviour. SourceNode-stamping (Task 12) — adds the optional
+    /// behaviour. SourceNode-stamping — adds the optional
     /// <see cref="INodeIdentityProvider"/> so central-origin rows (Notification
     /// Outbox dispatch, Inbound API) carry the writing central node's
     /// identifier when the caller hasn't already supplied one. Optional /
-    /// defaulting-to-null so M4 test composition roots that don't pass a
+    /// defaulting-to-null so test composition roots that don't pass a
     /// provider keep working — the caller-wins discipline means an absent
     /// provider simply leaves SourceNode at whatever the caller set (often
     /// null, which is the legacy behaviour).
@@ -81,8 +81,8 @@ public sealed class CentralAuditWriter : ICentralAuditWriter
     {
         _services = services ?? throw new ArgumentNullException(nameof(services));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
-        // AuditLog-008: never default to null — over-redact instead.
-        // C3 (Task 2.5): wired via the canonical IAuditRedactor seam.
+        // Never default to null — over-redact instead.
+        // Wired via the canonical IAuditRedactor seam.
         // SafeDefaultAuditRedactor applies HTTP header redaction with
         // hard-coded sensitive defaults so a composition root that omits the
         // real redactor still scrubs Authorization / X-Api-Key / Cookie /
@@ -106,13 +106,13 @@ public sealed class CentralAuditWriter : ICentralAuditWriter
         try
         {
             // Redact BEFORE stamping IngestedAtUtc + handing to the repo. The
-            // redactor contract is "never throws". AuditLog-008: _redactor is
+            // redactor contract is "never throws". _redactor is
             // now non-null (SafeDefaultAuditRedactor fallback) so header
             // redaction always runs even in composition roots that omit the
             // real redactor.
             var filtered = _redactor.Apply(evt);
 
-            // SourceNode-stamping (Task 12): caller-provided value wins
+            // SourceNode-stamping: caller-provided value wins
             // (supports any future direct-write callsite that already has its
             // own node id); otherwise stamp from the local
             // INodeIdentityProvider, when one is wired. Production DI on
@@ -126,7 +126,7 @@ public sealed class CentralAuditWriter : ICentralAuditWriter
 
             await using var scope = _services.CreateAsyncScope();
             var repo = scope.ServiceProvider.GetRequiredService<IAuditLogRepository>();
-            // C3 transitional shim: IngestedAtUtc is a DetailsJson field on the
+            // IngestedAtUtc is a DetailsJson field on the
             // canonical record, so stamp it via the projection helper.
             var stamped = AuditRowProjection.WithIngestedAtUtc(filtered, DateTime.UtcNow);
             await repo.InsertIfNotExistsAsync(stamped, ct).ConfigureAwait(false);
@@ -134,7 +134,7 @@ public sealed class CentralAuditWriter : ICentralAuditWriter
         catch (Exception ex)
         {
             // Audit failure NEVER aborts the user-facing action — swallow and log.
-            // M6 Bundle E (T8): also surface the failure on the central health
+            // Also surface the failure on the central health
             // counter so a sustained audit-write outage is visible on the
             // health dashboard rather than disappearing into the log file.
             try