Comments: drop audit tags (macOS); delete unused entitlements.browser.plist; CI guard

[wenkaifan0720]

The macOS half of the pass #53 did for Windows, Dart and tooling, plus a CI check so the tags don't come back.

Comments. The macOS plugin and host still carried references a reader can't resolve: audit ids (C1–C3, H1–H9, R2, "audit P3"), the visibility/resize audit's fix ids (F-1…F-6, C-3), the agent-control plan's phase ids (CEF-1, CEF-2a/b, P2-step1/2), the persistent-profile contract's section numbers (F.3–F.5, A.4, H.6), a "#138 consolidation", and pointers to specs/cef-passkey/PLAN.md in work_canvas, another repo. Before this PR, 173 lines carried one of these tags (141 of them matched by the sweep's finder regex). Now none do. Each tag is replaced by its reason in words, or dropped where the sentence already gave it. A repeated idea is restated briefly each time; for example, "(H3)" becomes "the plugin's maps are main-thread confined". Two leftovers outside the package are fixed too: profile_probe.dart named a spike-era output directory the code no longer uses, and channel_probe_shared.dart cited the "#138 consolidation". The one non-comment change is the log line [cef] C2 respawn ephemeral host failed → [cef] ephemeral respawn failed. Nothing in the repo matches on it.

The Mach message audit trailer in SurfacePort.swift (auditTrailer, mach_msg_audit_trailer_t) is a real kernel term and is left alone.

entitlements.browser.plist deleted. It was left over from the passkey spike, and nothing signs with it. The build's post-build codesign (CMakeLists.txt) and tool/bundle_cef_host.sh sign cef_host and every helper with one file: entitlements.release.plist for CEF_HOST_ADHOC=OFF or a real identity (which is what publish-cef-host.sh builds), otherwise entitlements.plist. Nothing applies a separate browser-only file. The note in entitlements.release.plist claimed otherwise. It now says the file is shared by the host and its helpers, which is why it carries no keychain-access-groups: a helper with that group and no provisioning profile is AMFI-killed. It also says an app that wants Touch ID passkeys has to re-sign its bundled cef_host itself. The CMakeLists.txt comment beside the entitlements selection said both sets keep allow-unsigned-executable-memory and disable-library-validation. Only the dev set does, so that comment is corrected too. The whole repo was grepped first, and the release plist's note was the only reference to the file.

This changes the cef_host prebuilt input hash (native/cef_host/** is hashed). A republish is already pending; nothing is published here.

CI guard. tool/check_comment_tags.sh greps tracked files, skipping docs/history/, CHANGELOGs and binary files, for the shapes that are never anything else:

• LAW <n>, the all-caps word SLICE, SPIKES.md
• line citations <name>.(mm|cc|cpp|h|swift|dart):<digits>
• a comment (after //, ///, # or *) that opens with [A-Z]\d{1,2}(/[A-Z]\d{1,2})?:
• a parenthesised label \((audit )?[A-Z]\d{1,2}\)

It prints file:line: text per hit and exits 1. It uses only git and POSIX ERE, runs under macOS /bin/bash 3.2 and on Ubuntu, and has no allowlist. It runs as the first step of the analyze-test job, and CONTRIBUTING.md mentions it in one sentence. On main it reports 56 hits, all real tags, which this PR fixes. On the commit before #53 it reports 239.

Verification

• Comments only: the comment-stripped token stream of every changed Swift, Obj-C++ and header file is identical to main's. Only the log string above differs. The .mm/.h files were also cross-checked with GNU cpp -fpreprocessed.
• FLUTTER_CEF_STOCK_FRAMEWORK=1 native/build_cef_host.sh builds cef_host.app.
• All six Swift suites (packages/flutter_cef_macos/test/run_*.sh) pass. flutter analyze is clean, and flutter test passes (280 tests).
• bash -n passes on the new and touched scripts.
• Negative control: appending // H2: x to ResizeWatchdogPolicy.swift makes the guard fail, on macOS bash 3.2 and on Ubuntu 24.04. /// C1/H2:, (audit P3), LAW 4, SLICE, SPIKES.md, main.mm:123, # F9: and * X12: are each caught too, and (x64), (F1-F12), C0, V8/, slice(1) are not. After removal, the guard is clean again.

🤖 Generated with Claude Code