Trim verbose comments on the hardening changes

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: patocallaghan

.github/workflows/publish.yml

@@ -8,8 +8,8 @@ permissions:
   contents: read              # workflow default (least privilege); only stage-publish also needs id-token, granted on that job
 
 concurrency:
-  group: publish-${{ github.workflow }}   # serialize all publish runs; never two staged releases racing for a dist-tag
-  cancel-in-progress: false               # queue, don't cancel: killing a half-done `npm stage publish` is the torn state we're avoiding
+  group: publish-${{ github.workflow }}   # serialize publishes; no dist-tag races
+  cancel-in-progress: false               # queue, don't kill an in-flight publish
 
 jobs:
   verify:
@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
         with:
           persist-credentials: false
-          fetch-depth: 0                   # full history so origin/<default> ancestry is computable; checkout fetches authenticated before stripping creds
+          fetch-depth: 0                   # full history for the ancestry check below
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'      # pin >= 22.14.0
@@ -40,7 +40,7 @@ jobs:
   stage-publish:
     needs: verify
     runs-on: ubuntu-latest
-    timeout-minutes: 15         # bound a hung publish instead of running to the 6h default
+    timeout-minutes: 15         # cap a hung publish
     permissions:
       contents: read
       id-token: write           # OIDC trusted publishing: only this job mints the token