refact(comments): state the mechanism, not the incident

Every comment that invoked a 'law' (50 word-boundary sites across 28
tracked files) now states what is going on and why, in terms that
transfer to any project: gate twins drift until one side greenlights
what the other refuses; a tag re-points while a digest pins; a
restrictive engine behavior belongs to the runtime that imposed it and
must be re-tested, not inherited; a speculative head is tensors in the
file, not a flag; snapshot links dangle where the container resolves
them; exit 0 is a clean stop to systemd, so a self-exiting daemon on
on-failure goes dark reporting success. Event narratives and dates are
gone from these comments; the mechanics carry the argument.

Behavior-identical: bash -n, py_compile, yaml parse, full bats suite
408/408 green. One symbol rename rides along (stack script local
scale_law -> scale_contract, with its log text).

scripts/download-frank-dragoon-halogen.sh

@@ -1,13 +1,15 @@
 #!/usr/bin/env bash
 # download-frank-dragoon-halogen.sh — fetch frank-dragoon's halogen payload:
 # the qwen3.8-27b .hgn checkpoint and the export tokenizer, from the
-# PUBLIC peonist-ai/halogen-qwen3.8-27b repo (no token — and per the fleet
-# secret law, none would ever touch argv).
+# PUBLIC peonist-ai/halogen-qwen3.8-27b repo (no token — and a token
+# would never travel in argv: command lines are world-readable through
+# /proc, so a secret placed there leaks to any process-listing tool).
 #
-# The fetch law, same as every sibling script: curl -f (an access error
-# must not become a "successful" 153-byte artifact), exact byte count from
-# the model card, LFS sha256 verification, --verify-only to re-check an
-# existing payload without downloading.
+# The fetch rules, uniform across every sibling script: curl -f so an
+# access error fails loudly instead of writing the error body as a
+# "successful" tiny artifact; the exact byte count from the model card;
+# LFS sha256 verification; --verify-only to re-check an existing payload
+# without downloading.
 set -euo pipefail
 
 DEST="${FRANK_DRAGOON_MODEL_DIR:-$HOME/models/halogen-qwen3.8-27b}"