comments: replace law idiom with the mechanism it encoded

Every comment that cited a named law, an incident date, or an
internal nickname now states the underlying mechanism and why it
matters, generically: curl exit-0 artifacts and byte-count gates,
argv-in-/proc secret exposure, tag mutability vs digest pinning,
shape-specialized kernels refusing uncompiled slot counts, MTP heads
as file tensors no flag can supply, drafter/slot coupling as an
engine property, pkill -f matching its invoker, pinned-RAM pairing
with LimitMEMLOCK, one-encoding-per-table, the short-run first-token
noise floor, and the protected-expert rule. No behavior change:
comment/string text only; suite green (371 tests).

scripts/download-frank-dragoon-halogen.sh

@@ -1,10 +1,11 @@
 #!/usr/bin/env bash
 # download-frank-dragoon-halogen.sh — fetch frank-dragoon's halogen payload:
 # the qwen3.8-27b .hgn checkpoint and the export tokenizer, from the
-# PUBLIC peonist-ai/halogen-qwen3.8-27b repo (no token — and per the fleet
-# secret law, none would ever touch argv).
-#
-# The fetch law, same as every sibling script: curl -f (an access error
+ # PUBLIC peonist-ai/halogen-qwen3.8-27b repo (no token — and a token never
+ # rides a command line: argv is readable by every process on the host
+ # through /proc, so a key placed there is a key exposed).
+ #
+ # The fetch discipline, same as every sibling script: curl -f (an access error
 # must not become a "successful" 153-byte artifact), exact byte count from
 # the model card, LFS sha256 verification, --verify-only to re-check an
 # existing payload without downloading.