Core and desktop comments describe the code to a stranger (#6224)

Milestone 546 "Bring the repo to the comment standard (rule 32) and
compose defaults (rule 198)", step #6224 "Comment standard sweep: Rust
core and desktop client".

Doc comments and comments across inkwell-core, the Tauri app and
desktop/packaging now say what the code does and the non-obvious why in
the present tense. Gone: milestone tags (M10.x, M11.3, M13, M304, M315,
M314, milestone 325), issue and Scribe-note numbers, family-idea and
family-rule citations, the run numbers and commit hashes behind past
bugs, and the narration of what used to be (the stable channel before it
held its own bundles, CARGO_PKG_VERSION as the shown version, the
MANIFEST_TAG split, the store's missing tests, the old PKGBUILD). The
schema's migration notes keep what each step does and why, without
"until now". The forge is called the forge rather than Forgejo.

Hazards stay as facts: the dev-rolling tag that must not shadow the
branch, the manifest matched on this build's version, the APK's fixed
name surviving the prune, the LIKE guard in v9, -wal/-shm moving with
the renamed store, panic = abort ending the app.

34 files, comments only: a comment-stripping diff of every changed file
against HEAD is identical.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

desktop/packaging/install.sh

@@ -16,12 +16,8 @@
 #   stable (default) — the rolling build from every merge to `main`.
 #   dev              — the rolling build from every green push to `dev`.
 # Both are fixed-tag releases: the tag never moves and the assets are pruned to the
-# current build, so the tag alone names the newest one. `stable` only became one in
-# M314 step 3, when `main` started publishing — before that it was a manifest-only
-# pointer at whatever `v*` tag somebody had last cut, and this script carried a
-# fallback that chased the `v*` release its manifest named. That came out once
-# `main` had published to `stable` for real (`b6673c6`); the two channels are the
-# same shape now and nothing here should special-case one of them again.
+# current build, so the tag alone names the newest one. The two channels are the
+# same shape, and nothing here special-cases either.
 # Pick one with `--channel dev` or `INKWELL_CHANNEL=dev`. Through a pipe the options go
 # after a `--`:  curl -fsSL <url> | sh -s -- --channel dev
 #
@@ -36,7 +32,7 @@
 #   * everything else (Fedora/openSUSE/…) -> the de-bundled AppImage,
 #     installed user-locally (no sudo). The AppImage's graphics libs are
 #     stripped in CI (see debundle-graphics.sh), so it uses the host GPU stack
-#     and renders where a stock Tauri AppImage would black-window (issue 2021).
+#     and renders where a stock Tauri AppImage would black-window.
 #
 # POSIX sh (dash-safe) so `curl … | sh` works everywhere. Dependency-light and
 # auditable on purpose — read it before you pipe it.
@@ -122,9 +118,8 @@ if [ -n "$server" ]; then
 fi
 
 # --- architecture gate ------------------------------------------------------
-# Only x86_64 is built today; arm64 will be added when the CI matrix grows. The
-# release-asset naming carries the arch, but since only one arch ships now we
-# match by file extension below and just guard the arch here.
+# Only x86_64 is built. The release-asset naming carries the arch, but with one
+# arch shipping we match by file extension below and just guard the arch here.
 arch="$(uname -m)"
 case "$arch" in
   x86_64 | amd64) : ;;
@@ -148,7 +143,7 @@ fetch() {
 # The download against the digest its server published, BEFORE it reaches pacman,
 # dpkg or a menu entry: a truncated file installs as something broken rather than
 # failing. The forge path publishes no digest per bundle, so it passes an empty one
-# and this checks nothing there; that is the forge path exactly as it always was.
+# and this checks nothing there.
 verify() {
   [ -n "$2" ] || return 0
   if have sha256sum; then
@@ -231,8 +226,8 @@ say "Finding the latest Inkwell build on the $channel channel…"
 # channel — which is exactly what an installer wants and what the in-app updater
 # already reads.
 # The channel's RELEASE TAG, which is not always its name: `dev` publishes on the
-# tag `dev-rolling`, because a tag called `dev` shadowed the branch of the same name
-# and broke `git push origin dev` (Scribe #2184). Same mapping as
+# tag `dev-rolling`, because a tag called `dev` would shadow the branch of the same
+# name and break `git push origin dev`. Same mapping as
 # packaging/channel-tag.sh — inlined because this script is fetched alone through a
 # pipe and has nothing to source.
 case "$channel" in
@@ -269,9 +264,9 @@ revoke_token() {
 }
 
 # Tell the app which channel it was installed from. The installer is the only thing
-# that knows, and without this the app kept its own `stable` default and a dev install
-# checked the stable feed — which advertises an OLDER version — reporting "up to date"
-# forever (issue 2183).
+# that knows; without this the app keeps its own `stable` default, and a dev install
+# would check the stable feed, which advertises an OLDER version, and report "up to
+# date" forever.
 #
 # A plain file rather than a write into the app's SQLite store: shell has no business
 # knowing that schema, and a file it can't misread is the narrowest possible contract.
@@ -282,7 +277,7 @@ revoke_token() {
 # both sides hardcode it, so a change to the identifier has to change both.
 #
 # From a server, the sibling `install-server` is written instead: which server the app
-# came from, for the updater to follow (milestone 325, step 6). The channel marker is
+# came from, for the updater to follow. The channel marker is
 # left alone on that path, because a server's channel is whatever its image was built
 # with and nothing here can know it.
 record_channel() {
@@ -323,8 +318,8 @@ native_update_note() {
 
 # --- native pacman path (Arch/CachyOS/Manjaro) ------------------------------
 # Preferred over the AppImage on Arch: pacman pulls webkit2gtk-4.1 itself and the
-# app then runs against the host graphics stack, which is what keeps the
-# EGL_BAD_PARAMETER black window (issue 2021) from coming back. It also means the
+# app then runs against the host graphics stack, which is what avoids the
+# EGL_BAD_PARAMETER black window. It also means the
 # app is tracked by the package manager and uninstalls cleanly.
 if have pacman && [ -n "$pkg_url" ]; then
   say "Arch-family system detected — installing the native pacman package"