refactor: trim excessive comments from lockdown upper-bound PR

Condense multi-line narration into short, focused comments. Keep
only the non-obvious invariants (lockdown precedence, isolated
transport rationale) and drop restated code/step-by-step prose.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

pkg/github/dependencies.go

@@ -439,12 +439,10 @@ func (d *RequestDeps) GetRawClient(ctx context.Context) (*raw.Client, error) {
 	return rawClient, nil
 }
 
-// effectiveLockdownMode reports whether lockdown mode is active for the current
-// request. Server-side configuration (d.lockdownMode) is an upper bound: once the
-// operator has enabled lockdown mode, no request can disable it. Request-scoped
-// configuration (the X-MCP-Lockdown header, surfaced via ghcontext.IsLockdownMode)
-// may only tighten restrictions by enabling lockdown when the operator has not
-// already done so; it can never be used to relax server-enforced lockdown.
+// effectiveLockdownMode reports whether lockdown mode is active for the
+// request. d.lockdownMode is an operator-set upper bound: the per-request
+// X-MCP-Lockdown header (ghcontext.IsLockdownMode) can only enable lockdown,
+// never disable one the operator already turned on.
 func (d *RequestDeps) effectiveLockdownMode(ctx context.Context) bool {
 	return d.lockdownMode || ghcontext.IsLockdownMode(ctx)
 }

pkg/github/dependencies_test.go

@@ -198,13 +198,8 @@ func TestIsFeatureEnabled_EmptyFlagName(t *testing.T) {
 	assert.False(t, result, "Expected false for empty flag name")
 }
 
-// TestRequestDepsLockdownModeIsUpperBound verifies that, in HTTP mode, the
-// server operator's --lockdown-mode / GITHUB_LOCKDOWN_MODE configuration is an
-// upper bound: request-scoped configuration (the X-MCP-Lockdown header,
-// surfaced as ghcontext.WithLockdownMode) may enable or tighten lockdown, but
-// can never disable lockdown the operator has already turned on. Lockdown mode
-// remains a best-effort content filter, not a security boundary — this test
-// only asserts the on/off decision, not any content-filtering guarantee.
+// TestRequestDepsLockdownModeIsUpperBound verifies the X-MCP-Lockdown header
+// can only enable lockdown, never disable the operator's server-side setting.
 func TestRequestDepsLockdownModeIsUpperBound(t *testing.T) {
 	t.Parallel()
 
@@ -284,30 +279,25 @@ func TestRequestDepsLockdownModeIsUpperBound(t *testing.T) {
 	}
 }
 
-// TestRequestDepsLockdownModeCannotBeDisabledByOmittingHeader is a focused
-// regression test for the specific bug in #3104: previously, server-enabled
-// lockdown mode was disabled for any request that did not also send the
-// X-MCP-Lockdown header, letting a request silently opt out of an operator's
-// security posture. A request simply omitting the header (as opposed to
-// explicitly disabling it, which the header format does not support) must not
-// relax lockdown mode below what the operator configured.
+// TestRequestDepsLockdownModeCannotBeDisabledByOmittingHeader is a regression
+// test for #3104: omitting the X-MCP-Lockdown header must not disable
+// server-enabled lockdown mode.
 func TestRequestDepsLockdownModeCannotBeDisabledByOmittingHeader(t *testing.T) {
 	t.Parallel()
 
 	resolver := newRequestDepsAPIHostResolver(t, "https://example.com")
 	deps := github.NewRequestDeps(
 		resolver,
 		"test",
-		true, // server operator enabled lockdown mode
+		true, // server-enabled lockdown
 		nil,
 		translations.NullTranslationHelper,
 		0,
 		nil,
 		testExporters(),
 	)
 
-	// No ghcontext.WithLockdownMode call: this is what happens when a request
-	// does not send the X-MCP-Lockdown header at all.
+	// No X-MCP-Lockdown header sent.
 	ctx := ghcontext.WithTokenInfo(context.Background(), &ghcontext.TokenInfo{Token: "request-token"})
 
 	flags := deps.GetFlags(ctx)

pkg/http/transport/graphql_features_test.go

@@ -91,11 +91,9 @@ func TestGraphQLFeaturesTransport(t *testing.T) {
 	}
 }
 
-// TestGraphQLFeaturesTransport_NilTransport asserts the documented fallback to
-// http.DefaultTransport, so it must exercise that global rather than an
-// isolated transport. It therefore runs serially: httptest.Server.Close closes
-// http.DefaultTransport's idle connections, so a parallel test shutting down
-// its own server would otherwise be able to break this request.
+// TestGraphQLFeaturesTransport_NilTransport exercises the real
+// http.DefaultTransport fallback, so it can't run in parallel with tests that
+// close their own servers (that closes DefaultTransport's idle conns too).
 func TestGraphQLFeaturesTransport_NilTransport(t *testing.T) {
 	var capturedHeader string
 

pkg/http/transport/helpers_test.go

@@ -7,16 +7,10 @@ import (
 
 // newIsolatedTransport returns an http.Transport owned by a single test.
 //
-// httptest.Server.Close closes the idle connections of the process-global
-// http.DefaultTransport, regardless of which server is being shut down. Tests
-// here run in parallel and each shut down a server, so sharing
-// http.DefaultTransport lets one test's cleanup break another test's request
-// with "http: CloseIdleConnections called". Giving every test its own
-// transport keeps that global side effect out of reach.
-//
-// Use this wherever a test just needs a working transport. Tests that assert
-// behaviour specific to http.DefaultTransport must use it directly and must
-// not run in parallel.
+// Sharing http.DefaultTransport across parallel tests is unsafe: closing one
+// test's httptest.Server also closes DefaultTransport's idle connections,
+// breaking other tests still using it. Tests asserting DefaultTransport
+// fallback behavior specifically must use it directly and not run in parallel.
 func newIsolatedTransport(t *testing.T) *http.Transport {
 	t.Helper()