forge authz: scrub tracker tags from comments

Replace the #-number tracker references in code comments with prose
(tracker-tag lint; hive convention is prose in source). No behaviour
change. Branch-protection / collaborator / team / repo API field names
were verified against the live Forgejo swagger.

hive-c0re/src/agent_server.rs

@@ -318,7 +318,7 @@ fn valid_repo_name(name: &str) -> bool {
 }
 
 /// `CreateRepo` — create a repo for `agent` *through hive-c0re* in the
-/// c0re-owned `agents` org with operator-team branch protection (#1787).
+/// c0re-owned `agents` org with operator-team branch protection.
 /// The sanctioned create path now that agents can't create repos directly.
 async fn handle_create_repo(agent: &str, repo: &str) -> hive_sh4re::Response {
     if !valid_repo_name(repo) {

hive-c0re/src/forge.rs

@@ -51,7 +51,7 @@ const SHARED_DOCS_REPO: &str = "docs";
 /// Bind-mounted read-only into every container at `/knowledge`.
 /// See `hive-c0re/src/knowledge.rs`.
 const KNOWLEDGE_REPO: &str = crate::knowledge::REPO;
-/// Forgejo org that owns agent-created repos (#1787). Agents can't create
+/// Forgejo org that owns agent-created repos. Agents can't create
 /// repos with their own token (`max_repo_creation = 0`); instead hive-c0re
 /// creates them here and adds the requesting agent as a **write** member
 /// (not owner/admin). Because the org — not the agent — owns the repo,
@@ -66,7 +66,7 @@ const AGENTS_ORG: &str = "agents";
 /// rule never hardcodes a specific reviewer agent (which may not exist).
 const OPERATORS_TEAM: &str = "operators";
 /// Hive-managed Forgejo namespaces that agent-initiated repo creation must
-/// never target (#1787). `internal` is operator-curated shared content;
+/// never target. `internal` is operator-curated shared content;
 /// `agent-configs` + `core` are hive-c0re-internal mirror/meta namespaces.
 /// (`hyperhive` is NOT managed — it's just a repo that happens to be built
 /// by this hive.) hive-c0re's create path forces [`AGENTS_ORG`], so this is
@@ -271,7 +271,7 @@ async fn ensure_user_email(name: &str) {
 }
 
 /// Disable direct repo creation for agent `name` by setting
-/// `max_repo_creation = 0` on its Forgejo account (#1787). Agents must
+/// `max_repo_creation = 0` on its Forgejo account. Agents must
 /// create repos *through hive-c0re* (which owns the perms), never with
 /// their own token — a write-scoped token can otherwise create + own
 /// repos and self-merge, bypassing the operator-only-merge policy.
@@ -894,7 +894,7 @@ async fn ensure_org(name: &str, admin_token: &str) -> Result<()> {
 }
 
 /// Whether `ns` is a hive-managed Forgejo namespace that agent-initiated
-/// repo creation must never target (#1787) — `internal` (operator-curated
+/// repo creation must never target — `internal` (operator-curated
 /// shared content) + `agent-configs` / `core` (hive-c0re-internal). The
 /// create path forces [`AGENTS_ORG`], so this guards a future surface that
 /// might accept an explicit owner.
@@ -904,7 +904,7 @@ pub fn is_hive_managed_namespace(ns: &str) -> bool {
 }
 
 /// Provision the [`OPERATORS_TEAM`] inside [`AGENTS_ORG`] as an **empty**
-/// team (#1787). Branch protection on agents-org repos references it as the
+/// team. Branch protection on agents-org repos references it as the
 /// merge/approval whitelist; the operator adds herself as a member via the
 /// forge UI / hivectl. `includes_all_repositories` so the gate applies to
 /// every agent repo; `write` is enough to approve + merge. hive-c0re never
@@ -955,7 +955,7 @@ async fn add_collaborator(
 }
 
 /// Apply the operator merge-gate branch protection to `repo`'s default
-/// branch (#1787): only [`OPERATORS_TEAM`] members can merge, and an
+/// branch: only [`OPERATORS_TEAM`] members can merge, and an
 /// approving review from that team is required — so the author (a write-level
 /// agent, not in the team) cannot merge its own PR. Idempotent: an existing
 /// rule for the branch (200/409/422) is treated as success.
@@ -979,7 +979,7 @@ async fn apply_operator_branch_protection(repo: &str, token: &str) -> Result<()>
 }
 
 /// Create a repo for `agent` in the c0re-owned [`AGENTS_ORG`] and wire the
-/// #1787 perms: the org owns it (perms stay c0re-managed), the agent is added
+/// perms: the org owns it (perms stay c0re-managed), the agent is added
 /// as a **write** collaborator (not owner — can push + open PRs but can't
 /// bypass branch protection), and the default branch gets the operator
 /// merge gate. This is the sanctioned create path now that agents can't
@@ -1011,7 +1011,7 @@ pub async fn sync_agent(name: &str, core_token: Option<&str>) {
     // so commits link to the agent's Forgejo profile. Best-effort;
     // also patches up agents created before this fix (old @hive.local).
     ensure_user_email(name).await;
-    // Block direct agent-initiated repo creation (#1787): agents create
+    // Block direct agent-initiated repo creation: agents create
     // repos through hive-c0re, never with their own token. Idempotent +
     // marker-guarded; also covers agents provisioned before this landed.
     ensure_repo_creation_disabled(name).await;
@@ -1073,7 +1073,7 @@ pub async fn ensure_all() {
         }
         // Provision the operator merge-gate team (empty) inside the agents
         // org so branch protection can reference it before anyone joins
-        // (#1787). The operator adds herself as a member out-of-band.
+        //. The operator adds herself as a member out-of-band.
         if let Err(e) = ensure_operators_team(token).await {
             tracing::warn!(error = ?e, "forge: ensure_operators_team failed");
         }

hive-c0re/src/paths.rs

@@ -62,7 +62,7 @@ pub fn forge_email_aligned_marker(name: &str) -> PathBuf {
 
 /// `forge/repo-creation-disabled-<name>` — marker: `<name>`'s forge user
 /// has had `max_repo_creation = 0` applied (blocks direct agent-initiated
-/// repo creation — see #1787). One-shot guard so the PATCH runs once per
+/// repo creation). One-shot guard so the PATCH runs once per
 /// agent (including agents provisioned before the change); delete to
 /// re-apply.
 #[must_use]

hive-sh4re/src/lib.rs

@@ -572,7 +572,7 @@ pub enum Request {
     /// per-kind semantics in
     /// `docs/conventions.md::Loose-ends wire shape`.
     CancelLooseEnd { kind: CancelLooseEndKind, id: i64 },
-    /// Create a git repo *through hive-c0re* (#1787). Agents can't create
+    /// Create a git repo *through hive-c0re*. Agents can't create
     /// repos with their own forge token (`max_repo_creation = 0`); this is
     /// the sanctioned path. hive-c0re creates `repo` in the c0re-owned
     /// `agents` org, adds the calling agent as a write collaborator (not
@@ -966,7 +966,7 @@ pub enum ToolGroup {
     /// `get_logs` - *(privileged)*
     Diagnostics,
     /// `create_repo` — create git repos through hive-c0re (the only path
-    /// now that agents can't create them directly; see #1787). Opt-in per
+    /// now that agents can't create them directly). Opt-in per
     /// agent so the operator controls who can spin up repos.
     Forge,
     /// `run`, `status` (via `mcp__bash__*`)