docs(comments): rewrite comments across all crates to the guidelines

Sweep every first-party crate source (1956 .rs files) to the project comment
guidelines: delete redundant restatements, decorative banners, change
narration, and end-of-line comments; keep and tighten the crucial ones
(invariants, bug rationale, SAFETY blocks, ported-source attribution).

No functional code changed. Every edit is proven comment-only against the
prior tree by a comment-stripping lexer (string/char/raw-string aware) plus a
separate doctest-fence check. Where removing a comment made rustfmt or clippy
want to re-lay-out adjacent code, the minimal triggering comment is restored so
code tokens stay byte-identical.

Gates green: cargo fmt --all --check (0 diffs), cargo check and cargo clippy
--workspace --all-targets (0 warnings).

Adds scripts/check_codegen_comment_guidelines.py — the enforcement gate for
these guidelines (flags banners, end-of-line comments, change narration, and
commented-out code).

crates/codegen/kigi-shell-base/src/util/secure_file.rs

@@ -135,9 +135,10 @@ pub fn set_windows_secure_permissions(path: &Path) -> io::Result<()> {
         // Create explicit access entry for current user only
         // GENERIC_ALL = 0x10000000
         let explicit_access = EXPLICIT_ACCESS_W {
-            grfAccessPermissions: 0x10000000, // GENERIC_ALL
+            grfAccessPermissions: 0x10000000,
             grfAccessMode: SET_ACCESS,
-            grfInheritance: ACE_FLAGS(0), // No inheritance for files
+            // No inheritance for files
+            grfInheritance: ACE_FLAGS(0),
             Trustee: TRUSTEE_W {
                 pMultipleTrustee: std::ptr::null_mut(),
                 MultipleTrusteeOperation:
@@ -168,8 +169,10 @@ pub fn set_windows_secure_permissions(path: &Path) -> io::Result<()> {
             PCWSTR::from_raw(wide_path.as_ptr()),
             SE_FILE_OBJECT,
             DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION,
-            None, // psidOwner: not changing the owner
-            None, // psidGroup: not changing the primary group
+            // psidOwner: not changing the owner
+            None,
+            // psidGroup: not changing the primary group
+            None,
             Some(new_acl),
             None,
         );