docs(comments): strip internal task/milestone/bundle bookkeeping from code comments

Remove project bookkeeping citations from shipped code comments across the
solution: hyphenated task IDs (WP-14, StoreAndForward-025), milestone/task/
issue refs (M3, Task 4, Audit Log #23, #21), Bundle X task-bundle labels,
and C/D/K/S/T phase labels.

Comment text only — no code logic, string/log literals, or XML-doc structure
changed. Genuine descriptions are preserved (only the citation is stripped),
and technical lookalikes are retained (UTF-8, SHA-256, T00:00:00, M365,
UTC-5, pre-C4/pre-C5 schema versions). Flagged by the new CommentChecker
TaskReferenceInComment / TrackingReferenceInComment checks plus targeted
grep passes; full solution builds clean, append-only guard tests pass.

src/ZB.MOM.WW.ScadaBridge.Security/AuthorizationPolicies.cs

@@ -18,8 +18,7 @@ namespace ZB.MOM.WW.ScadaBridge.Security;
 /// </para>
 ///
 /// <para>
-/// Default role → permission mapping (#23 M7-T15 / Bundle G), post Task 1.7
-/// canonicalization + SoD collapse:
+/// Default role → permission mapping, post canonicalization + SoD collapse:
 /// <list type="table">
 ///   <listheader>
 ///     <term>Role</term>
@@ -50,7 +49,7 @@ namespace ZB.MOM.WW.ScadaBridge.Security;
 ///   </item>
 /// </list>
 /// <para>
-/// SoD collapse (Task 1.7): the legacy distinct audit roles were removed. The
+/// SoD collapse: the legacy distinct audit roles were removed. The
 /// former <c>Audit</c> role (full audit surface = read + bulk export) was
 /// collapsed into <c>Administrator</c> — a deliberate, accepted privilege
 /// escalation (former audit-only users gain the entire admin surface: create
@@ -75,14 +74,14 @@ public static class AuthorizationPolicies
     public const string RequireDeployment = "RequireDeployment";
 
     /// <summary>
-    /// Permission to initiate a two-person Secured Write (M7-A3 / T14a).
+    /// Permission to initiate a two-person Secured Write.
     /// Satisfied by the <see cref="Roles.Operator"/> role claim. Single-role
     /// policy mirroring <see cref="RequireAdmin"/>.
     /// </summary>
     public const string RequireOperator = "RequireOperator";
 
     /// <summary>
-    /// Permission to approve a two-person Secured Write (M7-A3 / T14a).
+    /// Permission to approve a two-person Secured Write.
     /// Satisfied by the <see cref="Roles.Verifier"/> role claim. Kept distinct
     /// from <see cref="RequireOperator"/> so initiation and approval are
     /// separable duties.
@@ -90,10 +89,10 @@ public static class AuthorizationPolicies
     public const string RequireVerifier = "RequireVerifier";
 
     /// <summary>
-    /// Read access to the Audit Log #23 surface (Audit Log page,
+    /// Read access to the Audit Log surface (Audit Log page,
     /// Configuration Audit Log page, Audit nav group). Granted to the
     /// <c>Administrator</c> role and the <c>Viewer</c> role (the latter being
-    /// the post-Task-1.7 home of the former <c>AuditReadOnly</c> role).
+    /// the home of the former <c>AuditReadOnly</c> role).
     /// </summary>
     public const string OperationalAudit = "OperationalAudit";
 
@@ -110,11 +109,11 @@ public static class AuthorizationPolicies
     /// so the seed/docs and the policy stay in lockstep.
     /// </summary>
     /// <remarks>
-    /// Public so the ManagementService HTTP API (#23 M8) — which gates the
+    /// Public so the ManagementService HTTP API — which gates the
     /// <c>/api/audit/*</c> routes with a manual Basic-Auth + LDAP role check
     /// rather than the ASP.NET authorization-policy pipeline — can reuse the
     /// exact same role set the <see cref="OperationalAudit"/> policy enforces.
-    /// Task 1.7: {<c>Administrator</c>, <c>Viewer</c>} (was {Admin, Audit,
+    /// {<c>Administrator</c>, <c>Viewer</c>} (was {Admin, Audit,
     /// AuditReadOnly} — the audit roles collapsed into Administrator/Viewer).
     /// </remarks>
     public static readonly string[] OperationalAuditRoles = { Roles.Administrator, Roles.Viewer };
@@ -127,7 +126,7 @@ public static class AuthorizationPolicies
     /// <remarks>
     /// Public for the same reason as <see cref="OperationalAuditRoles"/> —
     /// the ManagementService <c>/api/audit/export</c> route checks roles
-    /// against this set directly. Task 1.7: {<c>Administrator</c>} (was
+    /// against this set directly. {<c>Administrator</c>} (was
     /// {Admin, Audit}).
     /// </remarks>
     public static readonly string[] AuditExportRoles = { Roles.Administrator };