docs: strip task-tracking IDs from code comments and fill missing XML docs

Tracking IDs are review bookkeeping that rots in shipped source; the rationale they tagged is kept. Comment-only change (CommentChecker 458 -> 16 false positives).

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/GalaxyRepositoryHostWiringTests.cs

@@ -28,7 +28,7 @@ public sealed class GalaxyRepositoryHostWiringTests
     ///     Verifies the full production authz-filtering chain end-to-end.
     ///     Phase 1: an identity carrying no <c>BrowseSubtrees</c> pushed → <c>BrowseChildren</c>
     ///     returns both children (unconstrained). That, not an absent identity, is production's
-    ///     unscoped case since GWC-38 — with <c>Authentication:Mode=ApiKey</c> an absent identity
+    ///     unscoped case — with <c>Authentication:Mode=ApiKey</c> an absent identity
     ///     now denies, which the isolated provider test pins.
     ///     Phase 2: identity with <c>BrowseSubtrees = ["NonExistent"]</c>
     ///     pushed via <see cref="GatewayRequestIdentityAccessor"/> → the real

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/MxAccessGatewayServiceTests.cs

@@ -52,7 +52,7 @@ public sealed class MxAccessGatewayServiceTests
 
     /// <summary>
     ///     Verifies OpenSession forwards the calling key's dashboard-visibility tags, so the
-    ///     session's tags are derived from the owning API key rather than the wire request (SEC-25).
+    ///     session's tags are derived from the owning API key rather than the wire request.
     /// </summary>
     /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/MxAccessGrpcMapperTests.cs

@@ -41,7 +41,7 @@ public sealed class MxAccessGrpcMapperTests
 
     /// <summary>
     ///     The command-only overload exists so <c>Invoke</c> does not deep-clone the whole request just to
-    ///     overwrite and discard its command (GWC-29). It must still perform the one clone that keeps the
+    ///     overwrite and discard its command. It must still perform the one clone that keeps the
     ///     worker-bound graph unaliased from the caller-owned gRPC command, and must produce the same
     ///     <see cref="WorkerCommand"/> as the request overload.
     /// </summary>
@@ -145,7 +145,7 @@ public sealed class MxAccessGrpcMapperTests
     }
 
     /// <summary>
-    ///     Verifies MapEvent transfers ownership of the inner MxEvent (GWC-07 / IPC-05): the
+    ///     Verifies MapEvent transfers ownership of the inner MxEvent: the
     ///     returned reference is the same instance carried by the WorkerEvent, not a clone. The
     ///     WorkerEvent is discarded after mapping and the distributor pump is its single consumer,
     ///     so moving the inner event out is safe and avoids a per-event deep copy.