docs(comments): strip internal task/milestone/bundle bookkeeping from code comments

Remove project bookkeeping citations from shipped code comments across the
solution: hyphenated task IDs (WP-14, StoreAndForward-025), milestone/task/
issue refs (M3, Task 4, Audit Log #23, #21), Bundle X task-bundle labels,
and C/D/K/S/T phase labels.

Comment text only — no code logic, string/log literals, or XML-doc structure
changed. Genuine descriptions are preserved (only the citation is stripped),
and technical lookalikes are retained (UTF-8, SHA-256, T00:00:00, M365,
UTC-5, pre-C4/pre-C5 schema versions). Flagged by the new CommentChecker
TaskReferenceInComment / TrackingReferenceInComment checks plus targeted
grep passes; full solution builds clean, append-only guard tests pass.

src/ZB.MOM.WW.ScadaBridge.Security/SessionClaimBuilder.cs

@@ -4,7 +4,7 @@ using Microsoft.AspNetCore.Authentication.Cookies;
 namespace ZB.MOM.WW.ScadaBridge.Security;
 
 /// <summary>
-/// M2.19 (#15): the single, shared source of truth for the FULL set of claims that
+/// The single, shared source of truth for the FULL set of claims that
 /// back an interactive cookie session. BOTH the <c>/auth/login</c> endpoint and the
 /// <c>OnValidatePrincipal</c> mid-session role-refresh path build their principal
 /// through <see cref="Build"/>, so the two can never drift — the spec requires the
@@ -12,7 +12,7 @@ namespace ZB.MOM.WW.ScadaBridge.Security;
 /// </summary>
 /// <remarks>
 /// The claim shape is exactly what the login endpoint historically minted, plus the
-/// two M2.19 additions:
+/// two additions:
 /// <list type="bullet">
 ///   <item><see cref="ClaimTypes.Name"/> — resolves <c>Identity.Name</c>.</item>
 ///   <item><see cref="JwtTokenService.DisplayNameClaimType"/> — human display name.</item>
@@ -21,9 +21,9 @@ namespace ZB.MOM.WW.ScadaBridge.Security;
 ///   <item><see cref="JwtTokenService.SiteIdClaimType"/> — one per permitted site,
 ///         ONLY when the mapping is not system-wide (deny-by-omission preserved).</item>
 ///   <item><see cref="JwtTokenService.GroupClaimType"/> — one per raw LDAP group
-///         (M2.19): the durable input the mid-session RoleMapper re-run consumes.</item>
+///         — the durable input the mid-session RoleMapper re-run consumes.</item>
 ///   <item><see cref="JwtTokenService.LastRoleRefreshClaimType"/> — the role-mapping
-///         refresh anchor (M2.19), ISO-8601 round-trippable.</item>
+///         refresh anchor, ISO-8601 round-trippable.</item>
 ///   <item><see cref="JwtTokenService.LastActivityClaimType"/> — the idle-timeout
 ///         anchor; seeded to the refresh timestamp at login so idle-timeout can be
 ///         enforced consistently from the very first request.</item>