Studio: trim PR 5717 in-code comments to one short sentence each

Drops 234 lines of inline commentary across the renderer, sanitizer,
HTML preview route, supply-chain gate, and their tests. Same intent,
shorter form. No code behaviour changes; vitest 24/24, pytest 24/24,
tsc / vite build clean.

.github/workflows/security-audit.yml

@@ -1103,13 +1103,9 @@ jobs:
           BASE_SHA="${{ github.event.pull_request.base.sha }}"
           git show "$BASE_SHA:studio/frontend/package-lock.json" \
             > /tmp/base-package-lock.json
-          # Pull the TRUSTED allowlist from the base ref so a PR cannot
-          # allowlist its own new postinstall dependency in the same diff
-          # the checker scans. If the file does NOT exist on base, REMOVE
-          # the temp file -- the checker treats a missing base allowlist
-          # as bootstrap mode (the PR that introduces the file is allowed
-          # to populate it; once it lands, subsequent PRs must respect
-          # the head-only rejection rule).
+          # Pull TRUSTED allowlist from base so a PR cannot self-approve
+          # a new postinstall in the same diff. Missing-on-base = bootstrap
+          # mode (gate accepts head allowlist for THAT PR only).
           if ! git show "$BASE_SHA:studio/frontend/.install-script-allowlist" \
               > /tmp/base-install-script-allowlist 2>/dev/null; then
             rm -f /tmp/base-install-script-allowlist

.github/workflows/studio-frontend-ci.yml

@@ -110,10 +110,8 @@ jobs:
         run: npm run typecheck
 
       - name: Frontend unit tests (vitest)
-        # New vitest suite covers the HtmlSvgRenderer iframe sandbox /
-        # CSP / sanitizer contract. Run it before the build so a
-        # sanitizer regression fails the gate even if the bundle still
-        # builds clean.
+        # Covers HtmlSvgRenderer sandbox / CSP / sanitizer. Runs before
+        # build so a regression fails the gate even if the bundle is clean.
         run: npm run test
 
       - name: Build