docs(comments): rewrite comments across all crates to the guidelines

Sweep every first-party crate source (1956 .rs files) to the project comment
guidelines: delete redundant restatements, decorative banners, change
narration, and end-of-line comments; keep and tighten the crucial ones
(invariants, bug rationale, SAFETY blocks, ported-source attribution).

No functional code changed. Every edit is proven comment-only against the
prior tree by a comment-stripping lexer (string/char/raw-string aware) plus a
separate doctest-fence check. Where removing a comment made rustfmt or clippy
want to re-lay-out adjacent code, the minimal triggering comment is restored so
code tokens stay byte-identical.

Gates green: cargo fmt --all --check (0 diffs), cargo check and cargo clippy
--workspace --all-targets (0 warnings).

Adds scripts/check_codegen_comment_guidelines.py — the enforcement gate for
these guidelines (flags banners, end-of-line comments, change narration, and
commented-out code).

crates/codegen/kigi-shell/src/auth/credential_provider.rs

@@ -200,8 +200,7 @@ mod tests {
         );
         assert!(snap.user_id.is_none());
     }
-    /// 401 recovery routes through `unauthorized_recovery` (pre-fix
-    /// it no-oped because the refresher arg was hardcoded `None`).
+    /// 401 recovery routes through `unauthorized_recovery`.
     #[tokio::test]
     async fn refresh_after_unauthorized_drives_recovery_state_machine() {
         let _guard = EarlyInvalidationGuard::pin_to_default();
@@ -304,8 +303,6 @@ mod tests {
         .snapshot();
         assert!(oidc.deployment_id.is_none() && oidc.api_key_id.is_none());
     }
-    /// Bootstrap mode: `snapshot()` re-reads disk so sibling-rotated
-    /// tokens are picked up without a live AuthManager.
     #[test]
     fn deployment_key_wins_over_resolved_user_token() {
         let _guard = EarlyInvalidationGuard::pin_to_default();