docs(comments): strip internal task/milestone/bundle bookkeeping from code comments

Remove project bookkeeping citations from shipped code comments across the
solution: hyphenated task IDs (WP-14, StoreAndForward-025), milestone/task/
issue refs (M3, Task 4, Audit Log #23, #21), Bundle X task-bundle labels,
and C/D/K/S/T phase labels.

Comment text only — no code logic, string/log literals, or XML-doc structure
changed. Genuine descriptions are preserved (only the citation is stripped),
and technical lookalikes are retained (UTF-8, SHA-256, T00:00:00, M365,
UTC-5, pre-C4/pre-C5 schema versions). Flagged by the new CommentChecker
TaskReferenceInComment / TrackingReferenceInComment checks plus targeted
grep passes; full solution builds clean, append-only guard tests pass.

src/ZB.MOM.WW.ScadaBridge.InboundAPI/ForbiddenApiChecker.cs

@@ -3,18 +3,18 @@ using ZB.MOM.WW.ScadaBridge.ScriptAnalysis;
 namespace ZB.MOM.WW.ScadaBridge.InboundAPI;
 
 /// <summary>
-/// InboundAPI-005: Enforces the ScadaBridge script trust model on inbound API method
+/// Enforces the ScadaBridge script trust model on inbound API method
 /// scripts before they are compiled into executable handlers.
 ///
 /// This class is now a thin shim that delegates to the shared, authoritative
 /// <see cref="ScriptTrustValidator.FindViolations"/> implemented in
-/// <c>ZB.MOM.WW.ScadaBridge.ScriptAnalysis</c> (M3.4). The unified validator runs
+/// <c>ZB.MOM.WW.ScadaBridge.ScriptAnalysis</c>. The unified validator runs
 /// both a semantic symbol pass (catching alias / <c>global::</c> / <c>using static</c>
 /// escapes) and the reflection-gateway + <c>dynamic</c> / <c>Activator</c> syntactic
 /// hardening that previously lived exclusively in this file.
 ///
 /// <para>
-/// InboundAPI-015: a purely namespace-textual deny-list is bypassable because
+/// A purely namespace-textual deny-list is bypassable because
 /// reflection is reachable through members of <em>permitted</em> types that never
 /// spell a forbidden namespace, e.g.
 /// <c>typeof(string).Assembly.GetType("System.IO.File")</c>. The shared validator
@@ -22,8 +22,8 @@ namespace ZB.MOM.WW.ScadaBridge.InboundAPI;
 /// hardening — <c>GetType</c>, <c>Assembly</c>, <c>GetMethod</c>, <c>InvokeMember</c>,
 /// <c>CreateInstance</c>, and the <c>dynamic</c> keyword are all rejected. This
 /// remains hardening of a best-effort static check, <strong>not</strong> a true sandbox
-/// (see the security notes in <c>code-reviews/InboundAPI/findings.md</c>,
-/// InboundAPI-015). The check is defence-in-depth; genuine containment needs a
+/// (see the security notes in <c>code-reviews/InboundAPI/findings.md</c>).
+/// The check is defence-in-depth; genuine containment needs a
 /// runtime boundary (restricted <c>AssemblyLoadContext</c> / curated reference set /
 /// out-of-process sandbox).
 /// </para>