docs(comments): strip internal task/milestone/bundle bookkeeping from code comments

Remove project bookkeeping citations from shipped code comments across the
solution: hyphenated task IDs (WP-14, StoreAndForward-025), milestone/task/
issue refs (M3, Task 4, Audit Log #23, #21), Bundle X task-bundle labels,
and C/D/K/S/T phase labels.

Comment text only — no code logic, string/log literals, or XML-doc structure
changed. Genuine descriptions are preserved (only the citation is stripped),
and technical lookalikes are retained (UTF-8, SHA-256, T00:00:00, M365,
UTC-5, pre-C4/pre-C5 schema versions). Flagged by the new CommentChecker
TaskReferenceInComment / TrackingReferenceInComment checks plus targeted
grep passes; full solution builds clean, append-only guard tests pass.

src/ZB.MOM.WW.ScadaBridge.ScriptAnalysis/ScriptTrustPolicy.cs

@@ -6,7 +6,7 @@ using ZB.MOM.WW.ScadaBridge.Commons.Types;
 namespace ZB.MOM.WW.ScadaBridge.ScriptAnalysis;
 
 /// <summary>
-/// M3.1: the single authoritative source of truth for the ScadaBridge script
+/// The single authoritative source of truth for the ScadaBridge script
 /// trust model. Previously the forbidden-API deny-list, allowed exceptions,
 /// reflection-gateway member names, default metadata references, and default
 /// imports were duplicated (and disagreed) across four call sites — the
@@ -14,7 +14,7 @@ namespace ZB.MOM.WW.ScadaBridge.ScriptAnalysis;
 /// <c>ForbiddenApiChecker</c>, and the design-time deploy gate. This class
 /// fuses them into one collection set that <see cref="ScriptTrustValidator"/>
 /// and <see cref="RoslynScriptCompiler"/> consume; the four consumers delegate
-/// here in later tasks (M3.2–M3.5).
+/// here.
 ///
 /// <para>
 /// The deny-list is intentionally the UNION of the two existing
@@ -136,8 +136,8 @@ public static class ScriptTrustPolicy
     /// <i>allowed</i> namespace (the documented case being <c>Process</c> via
     /// <c>using System.Diagnostics;</c>): the symbol resolves to nothing, Pass 1's
     /// syntactic fallback ignores dotless identifiers, and Pass 2 never flags a
-    /// bare identifier — so the forbidden reference slips the validator entirely
-    /// (ScriptAnalysis-001). Anchoring these assemblies in the fallback keeps the
+    /// bare identifier — so the forbidden reference slips the validator entirely.
+    /// Anchoring these assemblies in the fallback keeps the
     /// semantic pass authoritative even in the degraded mode.
     ///
     /// <para>
@@ -232,7 +232,7 @@ public static class ScriptTrustPolicy
         // The TPA list was unavailable (single-file / AOT / trimmed host) — we
         // are about to fall back to the minimal set, which weakens the semantic
         // pass. Make the degradation LOUD (not silent): record the flag and emit
-        // a warning so operators/tests can detect the mode (ScriptAnalysis-001).
+        // a warning so operators/tests can detect the mode.
         var tpaAvailable = byPath.Count > 0;
         if (!tpaAvailable)
         {
@@ -255,7 +255,7 @@ public static class ScriptTrustPolicy
         // (the documented `Process` via `using System.Diagnostics;` case) still
         // resolves and is flagged authoritatively by the semantic pass. When the
         // TPA list is present these are already covered, so this only matters in
-        // the degraded mode (ScriptAnalysis-001). NOTE: these anchors are added
+        // the degraded mode. NOTE: these anchors are added
         // ONLY here, never to DefaultReferences — the compile gate must keep
         // rejecting forbidden types as undefined symbols.
         if (!tpaAvailable)
@@ -287,7 +287,7 @@ public static class ScriptTrustPolicy
     /// This is what <see cref="BuildAnalysisReferences"/> produces when
     /// <c>TRUSTED_PLATFORM_ASSEMBLIES</c> is unavailable. Exposed so the degraded
     /// mode can be exercised directly (e.g. by the adversarial tests proving the
-    /// SA-001 fallback hole is closed) without depending on the host actually
+    /// fallback hole is closed) without depending on the host actually
     /// lacking a TPA list.
     /// </summary>
     public static IReadOnlyList<MetadataReference> BuildMinimalFallbackReferences()