docs: strip task-tracking IDs from code comments and fill missing XML docs

Tracking IDs are review bookkeeping that rots in shipped source; the rationale they tagged is kept. Comment-only change (CommentChecker 458 -> 16 false positives).

src/ZB.MOM.WW.MxGateway.Tests/Configuration/GatewayOptionsValidatorTests.cs

@@ -778,7 +778,7 @@ public sealed class GatewayOptionsValidatorTests
     }
 
     /// <summary>
-    /// Verifies rooting is host-meaningful (SEC-33): a Windows drive-qualified literal fails on a
+    /// Verifies rooting is host-meaningful: a Windows drive-qualified literal fails on a
     /// Unix host (where it is not rooted) rather than being blessed and written as a junk-named
     /// relative file. On Windows the same literal is genuinely rooted and passes.
     /// </summary>
@@ -805,7 +805,7 @@ public sealed class GatewayOptionsValidatorTests
     }
 
     /// <summary>
-    /// Verifies MxGateway:Events:QueueCapacity above int.MaxValue/2 fails (GWC-24 rider): the value
+    /// Verifies MxGateway:Events:QueueCapacity above int.MaxValue/2 fails: the value
     /// flows into WorkerClient as checked(2 * EventChannelCapacity), which would otherwise overflow.
     /// </summary>
     [Fact]
@@ -1078,7 +1078,7 @@ public sealed class GatewayOptionsValidatorTests
             result.Failures!,
             f => f.Contains("MxGateway:Ldap:ServiceAccountPassword is required when LDAP login is enabled."));
 
-        // SEC-36: the message must steer the operator to the two supported out-of-band channels
+        // The message must steer the operator to the two supported out-of-band channels
         // (dev user-secrets, deployed env var) so a blanked/unresolved credential never gets
         // "fixed" by re-committing a value.
         Assert.Contains("dotnet user-secrets set", failure);
@@ -1258,7 +1258,7 @@ public sealed class GatewayOptionsValidatorTests
     }
 
     /// <summary>
-    /// Verifies the headroom rule's upper half (IPC-33): a worker-frame maximum more than two
+    /// Verifies the headroom rule's upper half: a worker-frame maximum more than two
     /// envelope reserves above the gRPC cap is rejected. The worker budgets a DrainEvents reply at
     /// the frame maximum less two reserves and the gateway returns that same reply through
     /// <c>Invoke</c>, so a wider gap lets the worker pack a reply the pipe carries and the gRPC send