docs(comments): strip internal task/milestone/bundle bookkeeping from code comments

Remove project bookkeeping citations from shipped code comments across the
solution: hyphenated task IDs (WP-14, StoreAndForward-025), milestone/task/
issue refs (M3, Task 4, Audit Log #23, #21), Bundle X task-bundle labels,
and C/D/K/S/T phase labels.

Comment text only — no code logic, string/log literals, or XML-doc structure
changed. Genuine descriptions are preserved (only the citation is stripped),
and technical lookalikes are retained (UTF-8, SHA-256, T00:00:00, M365,
UTC-5, pre-C4/pre-C5 schema versions). Flagged by the new CommentChecker
TaskReferenceInComment / TrackingReferenceInComment checks plus targeted
grep passes; full solution builds clean, append-only guard tests pass.

src/ZB.MOM.WW.ScadaBridge.NotificationService/CredentialRedactor.cs

@@ -1,7 +1,7 @@
 namespace ZB.MOM.WW.ScadaBridge.NotificationService;
 
 /// <summary>
-/// NS-009: Scrubs SMTP credential secrets out of free text (typically exception
+/// Scrubs SMTP credential secrets out of free text (typically exception
 /// messages echoed back by an SMTP server) before that text is written to a log.
 /// MailKit authentication exceptions can contain server responses that quote the
 /// supplied credentials; this prevents a password, client secret, or OAuth2 token
@@ -25,7 +25,7 @@ public static class CredentialRedactor
     /// <c>tenantId:clientId:clientSecret</c>. May be null.
     /// </param>
     /// <summary>
-    /// NS-025: minimum length for a colon-separated SECRET component to be
+    /// Minimum length for a colon-separated SECRET component to be
     /// considered worth masking. Twelve characters is the standard heuristic
     /// for "long enough to be a password / client secret"; shorter components
     /// (e.g. a 4-char user name like <c>root</c>, or a 7-char "from" alias)
@@ -52,7 +52,7 @@ public static class CredentialRedactor
 
         var result = text;
 
-        // NS-025: redact only the obviously-secret slots — the LAST
+        // Redact only the obviously-secret slots — the LAST
         // colon-separated component (the password in Basic, the client
         // secret in OAuth2) and the whole packed string — not the user
         // name / tenant id / client id. A short user name like "root" or