docs(xmldoc): fill missing XML docs + strip tracking-ID comments across src

Adds <summary>/<param>/<returns>/<inheritdoc> where missing and removes
project bookkeeping IDs (task/tracking refs) from shipped code comments,
so the docs read cleanly and CommentChecker is quiet except for known
false positives (PLC/protocol terms, event/IEqualityComparer inheritdoc).
Doc/comment-only; no logic changed; solution builds clean.

src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting/ScriptSandbox.cs

@@ -5,7 +5,7 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Scripting;
 
 /// <summary>
 ///     Factory for the compile-time sandbox every user script is built against.
-///     Implements Phase 7 plan decision #6 (read-only sandbox) by whitelisting only the
+///     Enforces a read-only sandbox by whitelisting only the
 ///     assemblies + namespaces the script API needs; no <c>System.IO</c>, no
 ///     <c>System.Net</c>, no <c>System.Diagnostics.Process</c>, no
 ///     <c>System.Reflection</c>. Attempts to reference those types in a script fail at
@@ -18,8 +18,8 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Scripting;
 ///         <c>mscorlib</c> / <c>System.Runtime</c> — this class overrides that with an
 ///         explicit minimal allow-list. The list is the same regardless of whether
 ///         <see cref="ScriptEvaluator{TContext, TResult}"/> uses the legacy
-///         <c>CSharpScript</c> path or the collectible-<c>AssemblyLoadContext</c> path
-///         (Core.Scripting-008): both go through <see cref="Build"/>.
+///         <c>CSharpScript</c> path or the collectible-<c>AssemblyLoadContext</c> path:
+///         both go through <see cref="Build"/>.
 ///     </para>
 ///     <para>
 ///         Namespaces pre-imported so scripts don't have to write <c>using</c> clauses:
@@ -43,6 +43,7 @@ public static class ScriptSandbox
     ///     to resolve <c>ctx.GetTag(...)</c> calls.
     /// </summary>
     /// <param name="contextType">The concrete script context type to use for compilation.</param>
+    /// <returns>The sandbox configuration (assembly references + default imports) to compile the script against.</returns>
     public static SandboxConfig Build(Type contextType)
     {
         if (contextType is null) throw new ArgumentNullException(nameof(contextType));
@@ -74,8 +75,8 @@ public static class ScriptSandbox
         // type by FQN — including the ones we forbid (HttpClient, File, Process,
         // Registry, etc.). Letting those types resolve at compile is intentional: the
         // hard security gate is ForbiddenTypeAnalyzer in step 3 of the compile pipeline
-        // (Core.Scripting-001 / -002 established the analyzer must be the sole gate
-        // because type forwarding makes any references-list-only restriction porous).
+        // (the analyzer must be the sole gate because type forwarding makes any
+        // references-list-only restriction porous).
         // The references list now serves only as scoping hygiene — out-of-band BCL
         // surface (operator-authored hosting helpers, third-party packages, app code)
         // is not on the list and stays unreachable.
@@ -118,7 +119,7 @@ public static class ScriptSandbox
                 string.Equals(name, "mscorlib.dll", StringComparison.Ordinal) ||
                 // Microsoft.Win32.Registry isn't a System.* DLL but the analyzer's
                 // Microsoft.Win32 deny-list relies on the type being resolvable so it
-                // can identify + reject it (Core.Scripting-001 / -002). Add the one
+                // can identify + reject it. Add the one
                 // DLL we need rather than broadening to Microsoft.* (which would also
                 // pull in compilers, build tooling, etc.).
                 string.Equals(name, "Microsoft.Win32.Registry.dll", StringComparison.Ordinal))