docs: strip task-tracking IDs from code comments and fill missing XML docs

Tracking IDs are review bookkeeping that rots in shipped source; the rationale they tagged is kept. Comment-only change (CommentChecker 458 -> 16 false positives).

src/ZB.MOM.WW.MxGateway.IntegrationTests/DashboardLdapLiveTests.cs

@@ -27,7 +27,7 @@ public sealed class DashboardLdapLiveTests
     private const string SharedDirectoryPassword = "password";
 
     /// <summary>
-    /// Dashboard visibility tags (SEC-25) used by the ACL scenarios below. They are operator-chosen
+    /// Dashboard visibility tags used by the ACL scenarios below. They are operator-chosen
     /// labels that exist only in this fixture's configuration and in the fake sessions' owner-tag
     /// list — nothing in the shared directory carries them.
     /// </summary>
@@ -168,7 +168,7 @@ public sealed class DashboardLdapLiveTests
     }
 
     /// <summary>
-    /// Verifies the SEC-25 tag grant end-to-end from a real LDAP bind: <c>gw-viewer</c>'s only
+    /// Verifies the tag grant end-to-end from a real LDAP bind: <c>gw-viewer</c>'s only
     /// group (GwReader) is mapped to the <c>team-a</c> visibility tag by <c>Dashboard:GroupToTag</c>,
     /// and the principal that bind produces is admitted by <see cref="IDashboardSessionAcl"/> for a
     /// <c>team-a</c>-tagged session but refused for a <c>team-b</c>-tagged one.
@@ -275,7 +275,7 @@ public sealed class DashboardLdapLiveTests
     };
 
     /// <summary>
-    /// The SEC-25 fixture map: GwReader is admitted as a Viewer and granted <c>team-a</c>. Both keys
+    /// The tagged fixture map: GwReader is admitted as a Viewer and granted <c>team-a</c>. Both keys
     /// name groups that already exist in the shared directory — the tag layer is config-only.
     /// </summary>
     private static DashboardOptions TaggedDashboardOptions() => new()

src/ZB.MOM.WW.MxGateway.IntegrationTests/WorkerLiveMxAccessSmokeTests.cs

@@ -526,7 +526,7 @@ public sealed class WorkerLiveMxAccessSmokeTests(ITestOutputHelper output)
             // Assert. But a silent fall-through to "operator only" (currentUserId 0)
             // quietly demotes the rest of this test from an authenticated round-trip
             // to a bare failure-reply-shape check, which a stale rig credential (e.g.
-            // TST-31) would otherwise hide indefinitely in nightly runs. Log the
+            // one that has expired) would otherwise hide indefinitely in nightly runs. Log the
             // outcome loudly — never the password (verifyUser only) — so that
             // degradation is visible in the test output even though it never fails
             // the test by itself.