docs: scrub the sidebar-agent ghost from comments and CLAUDE.md

20+ comments across 10 files still described the deleted sidebar-agent.ts as a
live process — including load-bearing architecture claims ('IMPORTED ONLY BY
sidebar-agent.ts', 'sidebar-agent fills this in on first prompt-injection
load', 'kill sidebar-agent' in shutdown docs) and ~60 lines of tombstone
blocks in server.ts enumerating deleted identifiers by name (a false grep
surface: searching processAgentEvent hit server.ts and looked live).

CLAUDE.md's security-stack section now documents the LIVE architecture: L1-L3
content filters + testsavant via the security sidecar subprocess; the
L4b/ensemble rows, the GSTACK_SECURITY_ENSEMBLE knob, and the 721MB DeBERTa
download are gone (deleted as dead code this wave) with an explicit
do-not-re-document note; attempts.jsonl is correctly attributed to
tunnel-denial-log.ts; the no-live-writer status of classifierStatus is stated.

Comments that survive now describe what IS, not what WAS: the promotion gate
in domain-skills.ts explains why classifier_score>0 is load-bearing given no
L4 load-time scan exists; file-permissions.ts names real sensitive files.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

browse/src/cdp-commands.ts

@@ -3,8 +3,8 @@
  *
  * Output for trusted methods is a plain JSON pretty-print.
  * Output for untrusted methods is wrapped with the centralized UNTRUSTED EXTERNAL
- * CONTENT envelope so the sidebar-agent classifier sees it (matches the pattern
- * used by other untrusted-content commands in commands.ts).
+ * CONTENT envelope so downstream consumers treat it as data, not instructions
+ * (matches the pattern used by other untrusted-content commands in commands.ts).
  */
 
 import type { BrowserManager } from './browser-manager';