docs: complete XML-doc coverage and strip internal tracking IDs from code comments

Resolve all CommentChecker findings across the gateway server, worker, tests,
and .NET client (314 -> 0 real issues): add missing <returns>/<summary>/<param>
on public and test members, convert Stream/interface overrides to <inheritdoc/>,
and remove internal task/issue tracking IDs (SEC-*, IPC-*, WRK-*, GWC-*, TST-*,
Client.Dotnet-*) from shipped code documentation while preserving the design
rationale prose. Shipped comments should not carry internal bookkeeping, and
complete XML docs keep the analyzer/TreatWarningsAsErrors gate and generated API
docs clean. The 6 remaining flags are heuristic false positives (MD5, UTC-4,
capacity-1, near-1601) left intact so real documentation is not corrupted.

Claude-Session: https://claude.ai/code/session_01DMXXvNuPekkkrTEyPNxEkW

src/ZB.MOM.WW.MxGateway.Tests/Configuration/GatewayOptionsTests.cs

@@ -14,7 +14,7 @@ public sealed class GatewayOptionsTests
         GatewayOptions options = BindOptions(new Dictionary<string, string?>());
 
         Assert.Equal(AuthenticationMode.ApiKey, options.Authentication.Mode);
-        // SEC-01: the default is derived from CommonApplicationData (C:\ProgramData on Windows,
+        // The default is derived from CommonApplicationData (C:\ProgramData on Windows,
         // /usr/share on Unix) rather than a Windows literal, so assert against the same derivation
         // to stay platform-correct.
         Assert.Equal(
@@ -35,7 +35,7 @@ public sealed class GatewayOptionsTests
         Assert.Equal(10, options.Worker.ShutdownTimeoutSeconds);
         Assert.Equal(5, options.Worker.HeartbeatIntervalSeconds);
         Assert.Equal(15, options.Worker.HeartbeatGraceSeconds);
-        // 16 MiB public gRPC cap plus the 64 KiB worker-frame envelope reserve (IPC-03 headroom).
+        // 16 MiB public gRPC cap plus the 64 KiB worker-frame envelope reserve for headroom.
         Assert.Equal((16 * 1024 * 1024) + (64 * 1024), options.Worker.MaxMessageBytes);
 
         Assert.Equal(30, options.Sessions.DefaultCommandTimeoutSeconds);

src/ZB.MOM.WW.MxGateway.Tests/Configuration/GatewayOptionsValidatorTests.cs

@@ -550,10 +550,6 @@ public sealed class GatewayOptionsValidatorTests
         Assert.True(result.Succeeded);
     }
 
-    // -------------------------------------------------------------------------
-    // SEC-01: security-sensitive paths must be rooted (absolute)
-    // -------------------------------------------------------------------------
-
     private static GatewayOptions CloneWithAuthentication(GatewayOptions source, AuthenticationOptions authentication)
         => new()
         {
@@ -606,10 +602,6 @@ public sealed class GatewayOptionsValidatorTests
             f => f.Contains("MxGateway:Tls:SelfSignedCertPath") && f.Contains("rooted"));
     }
 
-    // -------------------------------------------------------------------------
-    // SEC-04: DisableLogin production guard
-    // -------------------------------------------------------------------------
-
     private static GatewayOptions CloneWithDashboard(GatewayOptions source, DashboardOptions dashboard)
         => new()
         {
@@ -649,10 +641,6 @@ public sealed class GatewayOptionsValidatorTests
         Assert.True(result.Succeeded);
     }
 
-    // -------------------------------------------------------------------------
-    // SEC-06: LDAP plaintext transport production guard
-    // -------------------------------------------------------------------------
-
     /// <summary>Verifies plaintext LDAP transport (None) aborts startup in Production.</summary>
     [Fact]
     public void Validate_Fails_WhenLdapTransportNoneInProduction()
@@ -684,8 +672,6 @@ public sealed class GatewayOptionsValidatorTests
         Assert.True(result.Succeeded);
     }
 
-    // ---- SEC-11: MxGateway:Security validation ----
-
     private static GatewayOptions WithSecurity(SecurityOptions security) => new() { Security = security };
 
     /// <summary>Verifies the default security options pass validation.</summary>
@@ -791,7 +777,7 @@ public sealed class GatewayOptionsValidatorTests
 
     /// <summary>
     /// Verifies the default worker-frame maximum keeps the required envelope-overhead reserve above
-    /// the default public gRPC cap, so a stock configuration passes the IPC-03 headroom check.
+    /// the default public gRPC cap, so a stock configuration passes the headroom check.
     /// </summary>
     [Fact]
     public void Validate_Succeeds_WhenWorkerFrameMaxHasEnvelopeHeadroom()
@@ -803,7 +789,7 @@ public sealed class GatewayOptionsValidatorTests
     /// <summary>
     /// Verifies that a worker-frame maximum equal to the gRPC cap (zero headroom) fails validation:
     /// a maximally-sized accepted gRPC payload would not fit one worker frame once wrapped in a
-    /// WorkerEnvelope, faulting the whole session on the outbound write (IPC-03).
+    /// WorkerEnvelope, faulting the whole session on the outbound write.
     /// </summary>
     [Fact]
     public void Validate_Fails_WhenWorkerFrameMaxEqualsGrpcMaxWithoutHeadroom()