style(kvb-org-organize): drop the hardening bundles' rationale comments

The symlink, FIFO and tokenizer reasons live in the commit messages of
the bundles that added them, so the module docstrings of nofollow.py and
test_nofollow.py and three rationale lines in watch.py and queue.py go.
watch.py gets back the space after ROOT = that the PATH bundle lost.

🎯 Fix: 98 %
💥 Break: 1 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: 100 %
💰 Value: ?
🏆 Score: 97
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

skills/kvb-org-organize/scripts/nofollow.py

@@ -1,15 +1,3 @@
-"""Open, read, lock, append, replace and unlink files below a trusted directory without following a symlink.
-
-The council root is writable by every sandboxed agent of the same uid, while
-its hooks run outside the sandbox: a symlink planted at any name or directory
-below the root would turn a hook's read or write into one outside it, and a
-FIFO planted at a name would hang every agent's hook. Every function here
-opens the root and each directory below it with O_NOFOLLOW, relative to the
-directory before, and the final name with O_NOFOLLOW and O_NONBLOCK; a planted
-symlink, a `..` part, a path outside the root or anything but a regular file
-raises OSError.
-"""
-
 from __future__ import annotations
 
 import contextlib

skills/kvb-org-organize/scripts/watch.py

@@ -76,7 +76,7 @@ def sibling(name: str) -> ModuleType:
 
 nofollow = sibling("nofollow")
 hookpath = sibling("hookpath")
-ROOT =Path(os.environ.get("AGENTS_COUNCIL_ROOT", "/tmp/agents-council"))
+ROOT = Path(os.environ.get("AGENTS_COUNCIL_ROOT", "/tmp/agents-council"))
 CONFIG = Path(
     os.environ.get(
         "AGENTS_COUNCIL_CONFIG",
@@ -190,7 +190,6 @@ def unseen_alerts(session: str) -> list[str]:
 
 
 def write_text(path: Path, text: str) -> None:
-    # A full disk or a planted symlink refuses the write; the stage must still act, so it is dropped.
     try:
         nofollow.replace(ROOT, path, text, 0o600)
     except OSError:

skills/kvb-org-queue/scripts/queue.py

@@ -225,7 +225,6 @@ def holding() -> Iterator[tuple[str, int]]:
         try:
             yield tag, handle.fileno()
         finally:
-            # A symlink planted over holds/ refuses the unlink; the job's exit code must still come through.
             with contextlib.suppress(OSError):
                 nofollow.unlink(watch.ROOT, path)
 
@@ -652,7 +651,6 @@ def uncommented(command: str) -> str:
 
 
 def segments(command: str) -> list[list[str]]:
-    # bash drops a backslash-newline between words and starts a comment only at a word start; shlex does neither
     lexer = shlex.shlex(uncommented(command.replace("\\\n", "")), posix=True, punctuation_chars=True)
     lexer.whitespace_split = True
     lexer.commenters = ""

tests/test_nofollow.py

@@ -1,5 +1,3 @@
-"""Exercise nofollow.py: no open, read, lock, append, replace or unlink below a root follows a planted symlink."""
-
 from __future__ import annotations
 
 import importlib.util