style: align comments with the project conventions

Apply a codebase-wide comment audit against the comment conventions:
split banned semicolons and multi-sentence lines into one sentence per
line, cut cross-file and history narration, trim file-top headers to a
single purpose line, and drop verbosity that did not earn its place.
Prose docs (CLAUDE.md, install.md) get the same one-sentence-per-line
and no-semicolon treatment.

modules/agents/claude-code/claude-code.nix

@@ -5,8 +5,8 @@
   ...
 }:
 # Claude Code for the primary user, configured through home-manager, which ships
-# the package and manages ~/.claude. Login credentials are left unmanaged so they
-# survive rebuilds.
+# the package and manages ~/.claude.
+# Login credentials are left unmanaged so they survive rebuilds.
 let
   cfg = config.modules.agents.claude-code;
   user = config.user.name;
@@ -22,10 +22,8 @@ in
     cached credential while it lasts. Suitable for a single-user machine'';
 
   config = lib.mkIf cfg.enable {
-    # Keying sudo's credential cache per user rather than per terminal lets one
-    # authentication cover commands issued by processes holding no terminal of
-    # their own. Any process running as this user can spend that credential
-    # until it lapses, so this suits a single-user machine.
+    # Key the credential cache per user rather than per terminal, so one
+    # authentication covers the agent's terminal-less commands.
     security.sudo.extraConfig = ''
       Defaults timestamp_type=global
       Defaults timestamp_timeout=60
@@ -38,7 +36,7 @@ in
       programs.claude-code = {
         enable = true;
 
-        # Global agent instructions, rendered to ~/.claude/CLAUDE.md.
+        # The global agent-instructions file.
         context = ./CLAUDE.md;
 
         # One directory per skill, symlinked under ~/.claude/skills.

modules/agents/claude-code/hooks/agent-sudo-guard.sh

@@ -1,10 +1,10 @@
 #!/bin/sh
-# agent-sudo-guard.sh — refuse a privileged command while sudo's credential
-# cache is cold, naming the command that warms it.
+# Refuse a privileged command while sudo's credential cache is cold, naming the
+# command that warms it.
 #
 # Commands arrive here from subprocesses holding no terminal, so an uncached
-# sudo fails with a bare non-zero exit and no output, reading as an unexplained
-# stall. The probe below reads a cache keyed per user rather than per terminal,
+# sudo fails with a bare non-zero exit and no output, reading as an unexplained stall.
+# The probe below reads a cache keyed per user rather than per terminal,
 # so an authentication made in the operator's own terminal counts.
 
 input=$(cat)