docs: scrub the sidebar-agent ghost from comments and CLAUDE.md

20+ comments across 10 files still described the deleted sidebar-agent.ts as a
live process — including load-bearing architecture claims ('IMPORTED ONLY BY
sidebar-agent.ts', 'sidebar-agent fills this in on first prompt-injection
load', 'kill sidebar-agent' in shutdown docs) and ~60 lines of tombstone
blocks in server.ts enumerating deleted identifiers by name (a false grep
surface: searching processAgentEvent hit server.ts and looked live).

CLAUDE.md's security-stack section now documents the LIVE architecture: L1-L3
content filters + testsavant via the security sidecar subprocess; the
L4b/ensemble rows, the GSTACK_SECURITY_ENSEMBLE knob, and the 721MB DeBERTa
download are gone (deleted as dead code this wave) with an explicit
do-not-re-document note; attempts.jsonl is correctly attributed to
tunnel-denial-log.ts; the no-live-writer status of classifierStatus is stated.

Comments that survive now describe what IS, not what WAS: the promotion gate
in domain-skills.ts explains why classifier_score>0 is load-bearing given no
L4 load-time scan exists; file-permissions.ts names real sensitive files.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

browse/src/domain-skill-commands.ts

@@ -14,8 +14,9 @@
  *   - host is ALWAYS derived from the active tab's top-level origin (T3
  *     confused-deputy fix). Never accepted as an arg.
  *   - Save-time security uses content-security.ts L1-L3 filters (importable
- *     from the compiled binary, unlike the L4 ML classifier). The full L4
- *     scan happens in sidebar-agent.ts when the skill is loaded into a prompt.
+ *     from the compiled binary, unlike the L4 ML classifier). There is NO
+ *     load-time L4 scan today — it died with the chat path; the
+ *     classifier_score>0 promotion gate in domain-skills.ts compensates.
  *   - Output is structured: every success/error includes problem + cause +
  *     suggested-action. Matches the gstack house style.
  *
@@ -117,8 +118,8 @@ async function handleSave(args: string[], bm: BrowserManager): Promise<string> {
     );
   }
   // L1-L3 content filters (datamarking, hidden-element strip, ARIA regex,
-  // URL blocklist). The full L4 ML classifier runs at sidebar-agent prompt
-  // injection time, not here (CLAUDE.md: classifier can't import in compiled binary).
+  // URL blocklist). No L4 ML scan here — the classifier can't import in the
+  // compiled binary, and the load-time scan path no longer exists.
   const filterResult = runContentFilters(body, page.url(), 'domain-skill-save');
   if (filterResult.blocked) {
     logTelemetry({ event: 'domain_skill_save_blocked', host, reason: filterResult.message });
@@ -128,9 +129,9 @@ async function handleSave(args: string[], bm: BrowserManager): Promise<string> {
         'Action: review the body for suspicious instruction-like content; rewrite and retry.'
     );
   }
-  // L1-L3 score is binary (passed or not). For the L4 score field we leave 0
-  // (meaning "not yet scanned by ML classifier") — sidebar-agent fills this
-  // in on first prompt-injection load.
+  // L1-L3 score is binary (passed or not). The L4 score field stays 0
+  // ("never ML-scanned") — nothing fills it in today, which is exactly why
+  // the promotion gate in domain-skills.ts requires classifier_score > 0.
   const slug = getCurrentProjectSlug();
   const row = await writeSkill({
     host,