docs(comments): strip internal task/milestone/bundle bookkeeping from code comments

Remove project bookkeeping citations from shipped code comments across the
solution: hyphenated task IDs (WP-14, StoreAndForward-025), milestone/task/
issue refs (M3, Task 4, Audit Log #23, #21), Bundle X task-bundle labels,
and C/D/K/S/T phase labels.

Comment text only — no code logic, string/log literals, or XML-doc structure
changed. Genuine descriptions are preserved (only the citation is stripped),
and technical lookalikes are retained (UTF-8, SHA-256, T00:00:00, M365,
UTC-5, pre-C4/pre-C5 schema versions). Flagged by the new CommentChecker
TaskReferenceInComment / TrackingReferenceInComment checks plus targeted
grep passes; full solution builds clean, append-only guard tests pass.

src/ZB.MOM.WW.ScadaBridge.Security/Roles.cs

@@ -11,10 +11,10 @@ namespace ZB.MOM.WW.ScadaBridge.Security;
 /// (policy <c>RequireClaim</c> values + the audit role arrays), and at LDAP
 /// mapping rows configured by an operator. Holding the literals here means a
 /// rename either succeeds everywhere or fails to compile, eliminating the
-/// "string drift" class that Security-018 documented.
+/// "string drift" class.
 /// </para>
 /// <para>
-/// Task 1.7 canonicalization (auth normalization): role VALUES were
+/// Canonicalization (auth normalization): role VALUES were
 /// standardized onto the canonical six (<c>Viewer/Operator/Engineer/Designer/
 /// Deployer/Administrator</c>; only four are used by ScadaBridge). The legacy
 /// ScadaBridge role names were renamed/collapsed as follows:
@@ -30,10 +30,10 @@ namespace ZB.MOM.WW.ScadaBridge.Security;
 /// </list>
 /// <c>Engineer</c> exists in the canonical vocabulary but is unused by
 /// ScadaBridge, so it is intentionally not declared here. <c>Operator</c> is
-/// now declared (M7-A3 / T14a) for the two-person Secured Writes feature.
+/// now declared for the two-person Secured Writes feature.
 /// </para>
 /// <para>
-/// Secured Writes (M7-A3 / T14a): <c>Operator</c> initiates a secured write and
+/// Secured Writes: <c>Operator</c> initiates a secured write and
 /// <c>Verifier</c> approves it — two distinct global roles so a single principal
 /// cannot both initiate and approve (separation of duties). Both are coarse
 /// global roles, matching the existing role model; site scoping (if any) is
@@ -47,11 +47,11 @@ public static class Roles
     public const string Deployer = "Deployer";
     public const string Viewer = "Viewer";
 
-    /// <summary>Initiates a two-person Secured Write (M7-A3 / T14a). Canonical
+    /// <summary>Initiates a two-person Secured Write. Canonical
     /// vocabulary role; pairs with <see cref="Verifier"/> who approves.</summary>
     public const string Operator = "Operator";
 
-    /// <summary>Approves a two-person Secured Write (M7-A3 / T14a). Held by a
+    /// <summary>Approves a two-person Secured Write. Held by a
     /// principal distinct from the initiating <see cref="Operator"/>.</summary>
     public const string Verifier = "Verifier";