docs(comments): rewrite comments across all crates to the guidelines

Sweep every first-party crate source (1956 .rs files) to the project comment
guidelines: delete redundant restatements, decorative banners, change
narration, and end-of-line comments; keep and tighten the crucial ones
(invariants, bug rationale, SAFETY blocks, ported-source attribution).

No functional code changed. Every edit is proven comment-only against the
prior tree by a comment-stripping lexer (string/char/raw-string aware) plus a
separate doctest-fence check. Where removing a comment made rustfmt or clippy
want to re-lay-out adjacent code, the minimal triggering comment is restored so
code tokens stay byte-identical.

Gates green: cargo fmt --all --check (0 diffs), cargo check and cargo clippy
--workspace --all-targets (0 warnings).

Adds scripts/check_codegen_comment_guidelines.py — the enforcement gate for
these guidelines (flags banners, end-of-line comments, change narration, and
commented-out code).

crates/codegen/kigi-mcp/src/oauth.rs

@@ -28,14 +28,12 @@ const MCP_OAUTH_CLIENT_NAME: &str = "Kigi";
 /// a login completed in another window or process.
 const CREDENTIAL_POLL_INTERVAL: std::time::Duration = std::time::Duration::from_secs(2);
 
-// ---------------------------------------------------------------------------
 // Two-layer dedup: prevents duplicate browser tabs both within one process
 // (multiple async tasks / sessions) and across separate processes (leader
 // mode disabled, multiple `kigi` invocations).
 //
 // Layer 1 (cross-process): filesystem lock at $KIGI_SHARE_DIR/mcp_auth_{safe_name}.lock
 // Layer 2 (in-process):    watch channel so only one task runs the flow
-// ---------------------------------------------------------------------------
 
 /// In-process in-flight auth tracker. Keyed by server name.
 /// Each entry has a generation counter so that when a forced override evicts
@@ -69,7 +67,7 @@ pub async fn authenticate_mcp_server_dedup(
     byo_config: Option<&McpOAuthConfig>,
     force: bool,
 ) -> Result<(), String> {
-    // --- Layer 2: in-process dedup via watch channel ---
+    // Layer 2: in-process dedup via watch channel
     let mut in_flight = IN_FLIGHT_AUTH.lock().await;
 
     // Remove stale entries left by panicked leaders (sender dropped).
@@ -116,7 +114,7 @@ pub async fn authenticate_mcp_server_dedup(
     in_flight.insert(server_name.to_string(), InFlightEntry { rx, generation });
     drop(in_flight);
 
-    // --- Layer 1: cross-process dedup via filesystem lock (Unix only) ---
+    // Layer 1: cross-process dedup via filesystem lock (Unix only)
     // When force is set, skip the fs lock — the old leader may still hold it
     // and we don't want to block behind a stale browser flow.
     #[cfg(unix)]