ci(#1555): prose-ify legacy tracker tags; add lint:allow escape hatch

Clean the legacy backlog so the tracker-tag lint can become a required
gate (mara's warn-during-cleanup -> full-tree-enforcement path). Rewrite
the ~33 real `closes/see #NNN` provenance refs in doc-comments to prose
across hive-forge, hive-c0re, hive-ag3nt, hive-matrix-mcp, hive-sh4re,
and add a `lint:allow` line marker to check-issue-refs.sh for genuine
non-tracker `#<digits>` (a hash-digit heading-detection test input).
Tree is now lint-clean; tracker-tag lint ready to promote to required.

scripts/check-issue-refs.sh

@@ -19,16 +19,24 @@
 # overruns) and digit-runs followed by a letter — e.g. hash-route
 # fragments like #24h. Residual: a pure-numeric short hex (e.g. three
 # identical digits) trips it — write the six-digit form to dodge.
+#
+# Escape hatch: a line containing the marker `lint:allow` is exempt.
+# Reserve it for genuine `#<digits>` that aren't tracker tags — e.g. a
+# `#123` markdown-heading example or hash-prefixed test-input data —
+# and keep a short reason next to the marker. Don't use it to keep a
+# real tracker tag; rewrite those to prose.
 set -eu
 
 pattern='#[0-9]{2,5}([^0-9a-zA-Z]|$)'
 
 # `/dev/null` forces grep to always print a filename prefix, even when
 # xargs hands it a single file. `-r`/`-0` keep it robust to odd paths
-# and an empty file list.
+# and an empty file list. Lines carrying the `lint:allow` marker are
+# dropped (legitimate non-tracker `#<digits>`; see the header).
 hits="$(
   git ls-files -z '*.rs' '*.nix' '*.js' '*.ts' '*.css' '*.html' \
-    | xargs -0 -r grep -nE "$pattern" /dev/null 2>/dev/null || true
+    | xargs -0 -r grep -nE "$pattern" /dev/null 2>/dev/null \
+    | grep -v 'lint:allow' || true
 )"
 
 if [ -n "$hits" ]; then