chore(v1.100.3c): H-04 — drop internal-path comments from 3 tracked files (#507)

Closes repo hygiene audit finding H-04: 3 comment-only references
to files under /home/commonfolder/... that are not part of the
public repo. Particularly notable: the polkit rules file ships to
every install, so the reference was visible on every operator host.

Per locked rule "first verify the 3 H-04 sites still apply, then
fix only confirmed live ones": each site was grep-verified in the
current tree before edit.

Changes:
- cli/lib/nftban/lib/nftban_distro_config.sh:296 — drop
  "See: /home/commonfolder/POLKIT-PATH-AUDIT-REPORT.md"; reword
  surrounding comment.
- packaging/polkit-1/rules.d/30-nftban-panel.rules:243 — drop
  "// - /home/commonfolder/NFTBAN_PANEL_INTEGRATION_PLAN.md".
  Adjacent "Panel Integration Phase 1" reference preserved.
- tests/review/05_feeds_test.sh:28 — replace path with neutral
  phrasing "internal code-review checklist (05_FEEDS)".

Verification (locked gate):
  git grep -nE "/home/gituser|/home/commonfolder|nftban-v1.0-dev" \
    -- ":(exclude).claude/*"

Remaining hits are intentional and outside this slice's scope:
  - 5 × CHANGELOG.md (historical narrative quoting prior slice's
    audit gate text + cited paths — intentional record)
  - 1 × scripts/test_server_cleanup.sh:121 (one-shot dev cleanup
    script, not in audit H-list — handled separately)

Out of scope (deferred): H-05 / H-07 / H-08 / H-09 / H-16 / H-19.

Lifecycle completion lane (PR-25..PR-30) remains explicitly OPEN.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: itcmsgr

CHANGELOG.md

@@ -11,6 +11,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [Unreleased] - v1.100.3c Repo hygiene Phase A slice 1c (H-04)
+
+Closes audit finding **H-04**: 3 internal-path comments referencing files under `/home/commonfolder/...` that are not part of the public repo. Particularly notable: the polkit rules file ships to every install, so the reference was visible on every operator host.
+
+### Changed
+
+- `cli/lib/nftban/lib/nftban_distro_config.sh:296` — drop `# See: /home/commonfolder/POLKIT-PATH-AUDIT-REPORT.md`. Reword the surrounding comment to merge the description into one sentence.
+- `packaging/polkit-1/rules.d/30-nftban-panel.rules:243` — drop `// - /home/commonfolder/NFTBAN_PANEL_INTEGRATION_PLAN.md`. Adjacent "Panel Integration Phase 1" reference preserved.
+- `tests/review/05_feeds_test.sh:28` — replace path with neutral phrasing "internal code-review checklist (05_FEEDS)".
+
+All 3 sites verified live in current tree before edit (per locked rule "first verify the 3 H-04 sites still apply, then fix only confirmed live ones").
+
+### Out of scope (deferred)
+
+- H-05 / H-07 / H-08 / H-09 / H-16 / H-19 — separate Phase A slices.
+- Larger Phase A items (H-06 / H-11..H-19) — separate planning.
+
+Lifecycle completion lane (PR-25..PR-30) remains explicitly **OPEN**.
+
+---
+
 ## [Unreleased] - v1.100.3b Repo hygiene Phase A slice 1b (H-01 / H-02 / H-03)
 
 Mechanical dev-machine path cleanup across 6 files. Closes audit findings **H-01**, **H-02**, and **H-03**: hardcoded `/home/gituser/github/...nftban-v1.0-dev` and `/home/gituser/github/nftban-dev` defaults that leak the maintainer's filesystem layout and break non-author runs.

cli/lib/nftban/lib/nftban_distro_config.sh

@@ -291,9 +291,8 @@ nftban_distro_is_package_installed() {
 # =============================================================================
 # POLKIT PATH RESOLUTION
 # =============================================================================
-# Get canonical polkit rules directory for current distribution
+# Get canonical polkit rules directory for current distribution.
 # This is the SINGLE SOURCE OF TRUTH for polkit path resolution.
-# See: /home/commonfolder/POLKIT-PATH-AUDIT-REPORT.md
 #
 # Resolution order:
 #   1. Distro config [paths].polkit_rules_dir (preferred)

packaging/polkit-1/rules.d/30-nftban-panel.rules

@@ -240,7 +240,6 @@ polkit.addRule(function (action, subject) {
 // - commands.registry.yml: Defines panel_expose field
 //
 // Related Documentation:
-// - /home/commonfolder/NFTBAN_PANEL_INTEGRATION_PLAN.md
 // - Panel Integration Phase 1: Foundation (v1.0.19)
 //
 // =============================================================================

tests/review/05_feeds_test.sh

@@ -24,8 +24,8 @@
 # meta:updated_date="2026-02-27"
 # =============================================================================
 #
-# Validates the feeds module against the code review checklist in
-# /home/commonfolder/NFTBANREVIEW/05_FEEDS/INSTRUCTIONS.md
+# Validates the feeds module against the internal code-review checklist
+# (05_FEEDS).
 #
 # Checks performed (static analysis only, no network or runtime):
 #   1. Feed downloads use HTTPS (no plain HTTP URLs)