check-issue-refs: blanket-ban tracker tags in markdown too, no exceptions

docs/process/conventions.md

@@ -64,7 +64,8 @@ hive-c0re owns the host admin socket.
 is the wake-event-injection surface. Recipient is implicit — the
 agent the socket belongs to — and `from` is caller-chosen so the
 wake prompt can label the source verbatim (`"matrix: new message in
-#general"`, `"forge: PR #42 opened"`, etc.). Typical caller: an
+#general"`, `"forge: PR #42 opened"`, etc.). <!-- lint:allow: example strings, not real tags -->
+Typical caller: an
 in-container background task (the matrix daemon, a scraper, the
 forge-notify webhook subscriber) that needs to signal "external work
 has arrived" without going through the broker as a peer agent.

docs/process/gotchas.md

@@ -412,7 +412,7 @@ connects to the compositor at `127.0.0.1:<vnc_port>`.
   Wayland clients couldn't find the compositor — libwayland falls
   back to a headless display or errors out, the app "works" on a
   second invisible display, and the VNC session shows a blank weston
-  desktop (#540 double-screen).
+  desktop (`$HIVE_FORGE_URL/hyperhive/hyperhive/issues/540`, double-screen).
 - **VNC bind address**: Weston's `vnc-backend` has no CLI
   bind-address flag (unlike the `rdp-backend`'s `--address`), so the
   listener binds `0.0.0.0`. The harness relay only connects via