docs(comments): rewrite comments across all crates to the guidelines

Sweep every first-party crate source (1956 .rs files) to the project comment
guidelines: delete redundant restatements, decorative banners, change
narration, and end-of-line comments; keep and tighten the crucial ones
(invariants, bug rationale, SAFETY blocks, ported-source attribution).

No functional code changed. Every edit is proven comment-only against the
prior tree by a comment-stripping lexer (string/char/raw-string aware) plus a
separate doctest-fence check. Where removing a comment made rustfmt or clippy
want to re-lay-out adjacent code, the minimal triggering comment is restored so
code tokens stay byte-identical.

Gates green: cargo fmt --all --check (0 diffs), cargo check and cargo clippy
--workspace --all-targets (0 warnings).

Adds scripts/check_codegen_comment_guidelines.py — the enforcement gate for
these guidelines (flags banners, end-of-line comments, change narration, and
commented-out code).

crates/codegen/kigi-sandbox/tests/deny_paths_e2e.rs

@@ -134,7 +134,8 @@ fn assert_write_denied(label: &str, path: &Path) {
 fn assert_rename_bypass_blocked(label: &str, path: &Path, workspace: &Path) {
     let name = path.file_name().unwrap().to_string_lossy();
     let moved = workspace.join(format!("exfil-{name}"));
-    let _ = fs::rename(path, &moved); // expected to fail; bytes must not leak
+    // expected to fail; bytes must not leak
+    let _ = fs::rename(path, &moved);
     match fs::read_to_string(&moved) {
         Ok(c) if c.contains(MARKER) => {
             eprintln!("FAIL: {label} rename bypass exposed MARKER");
@@ -160,7 +161,7 @@ fn profile_from_env() -> kigi_sandbox::ProfileName {
     kigi_sandbox::ProfileName::Custom(std::env::var(PROFILE_ENV).expect(PROFILE_ENV))
 }
 
-// ── Subprocess entry point ──────────────────────────────────────────────
+// Subprocess entry point
 
 /// `#[ignore]`d — only runs when invoked by the parent test via `run_scenario`.
 #[test]
@@ -186,7 +187,8 @@ fn subprocess_entry() {
             match kigi_sandbox::bwrap_reexec_for_profile(&profile_from_env(), workspace) {
                 Some(mut cmd) => {
                     use std::os::unix::process::CommandExt;
-                    let err = cmd.exec(); // returns only if exec failed
+                    // returns only if exec failed
+                    let err = cmd.exec();
                     eprintln!("bwrap re-exec failed: {err}");
                     std::process::exit(2);
                 }
@@ -280,7 +282,7 @@ fn subprocess_entry() {
     }
 }
 
-// ── Parent test cases ───────────────────────────────────────────────────
+// Parent test cases
 
 /// Drive one deny case end-to-end: define a custom profile whose `deny` list is
 /// `deny_entries` (exact paths and/or globs), create each `target` (with the
@@ -418,7 +420,8 @@ fn deny_exact_paths_block_read_write_rename() {
         &[".env", "src/server.pem", "secretdir"],
         &[".env", "src/server.pem", "secretdir/inner.pem"],
         &["readable.txt"],
-        &[], // exact paths have no runtime/post-launch coverage to assert
+        // exact paths have no runtime/post-launch coverage to assert
+        &[],
     );
 }
 

crates/codegen/kigi-sandbox/tests/integration_test.rs

@@ -87,7 +87,7 @@ fn test_sandbox_logger() {
     let events = logger.take_events();
     assert_eq!(events.len(), 3);
 
-    // Buffer is now empty
+    // Buffer is empty
     let events2 = logger.take_events();
     assert!(events2.is_empty());
 }