docs(comments): rewrite comments across all crates to the guidelines

Sweep every first-party crate source (1956 .rs files) to the project comment
guidelines: delete redundant restatements, decorative banners, change
narration, and end-of-line comments; keep and tighten the crucial ones
(invariants, bug rationale, SAFETY blocks, ported-source attribution).

No functional code changed. Every edit is proven comment-only against the
prior tree by a comment-stripping lexer (string/char/raw-string aware) plus a
separate doctest-fence check. Where removing a comment made rustfmt or clippy
want to re-lay-out adjacent code, the minimal triggering comment is restored so
code tokens stay byte-identical.

Gates green: cargo fmt --all --check (0 diffs), cargo check and cargo clippy
--workspace --all-targets (0 warnings).

Adds scripts/check_codegen_comment_guidelines.py — the enforcement gate for
these guidelines (flags banners, end-of-line comments, change narration, and
commented-out code).

crates/codegen/kigi-shell/tests/test_mcp_permission_persistence.rs

@@ -217,7 +217,8 @@ async fn run_actor_test_full<F, Fut>(
                 cwd.clone(),
                 client_type,
                 policy,
-                vec![], // deny_read_globs
+                // deny_read_globs
+                vec![],
                 vec![],
                 initial_yolo,
                 None,
@@ -237,8 +238,6 @@ fn rule(action: RuleAction, pattern: &str) -> PermissionRule {
     }
 }
 
-// --- mcp_pre_decision-style end-to-end ---
-
 #[tokio::test]
 #[serial]
 async fn mcp_tool_grant_persists_and_short_circuits_next_request() {
@@ -364,11 +363,13 @@ async fn policy_ask_suppresses_mcp_tool_allowlist() {
                 cwd.clone(),
                 ClientType::KigiPager,
                 Some(policy),
-                vec![], // deny_read_globs
+                // deny_read_globs
+                vec![],
                 vec![],
                 false,
                 None,
-                false, // remember_tool_approvals
+                // remember_tool_approvals
+                false,
             );
 
             // Script an outright reject so we can confirm the prompt fires.
@@ -414,11 +415,13 @@ async fn policy_ask_suppresses_mcp_server_allowlist() {
                 cwd.clone(),
                 ClientType::KigiPager,
                 Some(policy),
-                vec![], // deny_read_globs
+                // deny_read_globs
+                vec![],
                 vec![],
                 false,
                 None,
-                false, // remember_tool_approvals
+                // remember_tool_approvals
+                false,
             );
 
             gw.expected.send(("reject-once".to_string(), None)).unwrap();
@@ -458,7 +461,8 @@ async fn policy_deny_takes_precedence_over_mcp_allowlist() {
                 cwd.clone(),
                 ClientType::KigiPager,
                 Some(policy),
-                vec![], // deny_read_globs
+                // deny_read_globs
+                vec![],
                 vec![],
                 false,
                 None,
@@ -703,8 +707,6 @@ async fn dont_ask_policy_denies_without_prompting() {
     .await;
 }
 
-// --- deny rules survive YOLO mode ---
-
 #[tokio::test]
 #[serial]
 async fn deny_rule_enforced_in_yolo_mode_bash() {