docs(src): refresh comments and docstrings

Comment-only changes outside learn/, plane/ and cli.py:

- model/pipeline.py: the `judge` its docstring contrasts with is the deleted
  model/judge.py, now named as such.
- fusion.py: the panels are deterministic and only review and vote; the
  "critique and revise" step belonged to the retired LLM panels.
- mcp.py: hunter tools stay inside the scan's stages, not "harness stages".
- fusion, mcp, gate, redaction, skills: their "Phase N" tags now say which
  plan they cite (the retired openrouter-sast-harness).

Requirement citations to retired specs stay: they explain where the code
came from. No behaviour change; the byte-identical benchmark golden passes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

src/openultrasast/fusion.py

@@ -1,11 +1,11 @@
-"""Fusion adjudication — OpenUltraCode-style two-panel deepening (Phase 13).
+"""Fusion adjudication — OpenUltraCode-style two-panel deepening (Phase 13 of the retired openrouter-sast-harness plan).
 
 Fusion is the deepening mechanism for findings that need more reasoning than the
 ranker → hunter → verifier → mapping loop provides: critical/high severity, verifier
 disagreement, static-vs-semantic evidence conflict, findings that gate a risky fix or
 disclosure, or an explicit high-assurance request. Two panels independently review the
 bounded evidence (one steel-manning the vulnerability case, one the false-positive
-case), critique and revise, vote, and a decider issues the final disposition.
+case) and vote, and a decider issues the final disposition.
 
 The panels and the decider are deterministic and auditable. Every fused finding receives
 exactly one of the five dispositions, and the decision discloses panel roles, votes and the

src/openultrasast/gate.py

@@ -1,4 +1,4 @@
-"""Detection-quality gate — the hard feasibility constraint (Phase 4 task 8).
+"""Detection-quality gate — the hard feasibility constraint (Phase 4 task 8 of the retired openrouter-sast-harness plan).
 
 Aggregate recall and false-positive rate over the benchmark corpus must clear the
 project goal: recall >= 90% AND false-positive rate < 10%. This gate is computed

src/openultrasast/mcp.py

@@ -1,8 +1,8 @@
-"""Narrow MCP server for OpenCode integration (Phase 12).
+"""Narrow MCP server for OpenCode integration (Phase 12 of the retired openrouter-sast-harness plan).
 
 Exposes only stable, project-level operations over MCP stdio (newline-delimited
 JSON-RPC 2.0), implemented with the standard library only. No tool exposes arbitrary
-shell, Docker, or internal hunter tools — those stay inside controlled harness stages.
+shell, Docker, or internal hunter tools — those stay inside the scan's own stages.
 The pure :meth:`McpServer.handle` dispatch is separated from the :func:`serve` stdio
 loop so the surface is unit-testable without a live client.
 """

src/openultrasast/model/pipeline.py

@@ -4,8 +4,8 @@ Everything before this module built an *arbiter* — something that judges a flo
 found on its own. Nothing proposed candidates to it, which is why the arbiter's recall was never comparable to
 a detector's: it could only report what it happened to find unaided.
 
-This is the wiring the architecture was designed around, and it turns on a distinction that `judge` alone
-conflated:
+This is the wiring the architecture was designed around, and it turns on a distinction that the first judge
+(`model/judge.py`, deleted 2026-10-02 because this module replaced it) conflated:
 
     the model CONTRADICTS    it has coverage at this site and says no — a sanitizer lies on the path, or the
                              sink is written in its declared-safe shape. The claim is dropped (Req 8.2).

src/openultrasast/redaction.py

@@ -1,4 +1,4 @@
-"""Secret redaction for traces and reports (Phase 15 hardening).
+"""Secret redaction for traces and reports (Phase 15 hardening of the retired openrouter-sast-harness plan).
 
 Scan artifacts (trace events, reports) can quote source code that contains live
 credentials. This module masks well-known secret shapes before they are persisted, so

src/openultrasast/skills.py

@@ -1,4 +1,4 @@
-"""Trail of Bits skill index + router (Phase 14).
+"""Trail of Bits skill index + router (Phase 14 of the retired openrouter-sast-harness plan).
 
 Security skills are scoped expertise, not global prompt bloat. Each skill is a small
 descriptor with routing metadata (languages, tags, vulnerability classes, stages) and