Rewrite tracking refs elsewhere shipped

Original work item (epic Task 10454, verbatim): - Remove Draft state from anywhere of the jaah-ce, agent-sdk, agent-connectors. It needs to be removed at the source and then propagated using standard mechanism - remove any references on the source of documents (especially do not mention any brands) - agent-sdk. must borrow and share the process from jaah-ce, as well as terms. We want them mirrors from the main repo. Only main branch for now - do we want the same with agent-connector? make sure it is up to date with agent-sdk - Look for any sensitive or internal information or any brands - scrub all old versions from all three repos Full settled inputs: the epic's `prd` and `architecture` artifacts (Task 10454; read with `task_read`/`artifact_read`). Decisions quoted below are verbatim from them. Child E3 — Tracking-ref sweep, area: every shipped file NOT under `apps/api/**` or `apps/web/**` — incl. `apps/jaahd/**`, `infra/community-edition/**`, shipped `tools/**`, `packaging/**` (e.g. `packaging/platform-pins.toml`), shipped `portfolio/fleet/*.md` and `docs/**`, `packages/{governance,evidence,acp-forks,agent-sdk,agent-connectors}` (architecture §1.7 tracking bullet, operator decision A1 "Rewrite at source"). Uses Child B's check, baseline and `tools/mirror/strip_refs.py`; covers Child C's `packages/agent-connectors`. Requirement (PRD verbatim): R7 category 3 "Internal tracking refs — `Task NNNN`, `epic NNNN`, `ADR-NNNN`, work-unit labels (`WU-…`), and paths to docs that do not ship." and S2 "Internal tracking refs are removed at the monorepo source for every file that ships to a mirror (comments and docs), not only stripped at build time, so source and mirror stay identical except for the edition rewrite; the publish check enforces their absence. Files that do not ship are out of scope." Method (architecture verbatim): "A codemod (`tools/mirror/strip_refs.py` …) removes the bare parenthetical forms `(Task N)`, `(ADR-NNNN)`, `, Task N)` and the trailing `— Task N`. Every remaining hit is rewritten by hand into a self-contained sentence. For example, "seen on the first staging publish, Task 10133" becomes "seen on a first publish to an empty repository". "per ADR-0036" becomes the rule itself, or a link to a doc that ships. Never leave a dangling clause: each child's reviewer reads the diff hunk by hunk." Which files ship: those in a built mirror tree (CE manifest `tools/community_edition/manifest.toml`, `packages/agent-sdk/mirror.toml`, `packages/agent-connectors/mirror.toml`). Paths to docs that do not ship: replace with the rule itself or a shipped doc. Delete the `sensitive_baseline.toml` tracking rows for this area. Comments only change — no behaviour change; ids inside test data that are functional (e.g. a test task id) are not tracking refs if they do not cite internal work. Credentials & reach: - `./dc check full`, unit and gate oracles | nothing beyond the worktree | n/a Out of scope: - Do NOT edit `apps/api/**` or `apps/web/**` (E1/E2). Do NOT touch `skynet` (K-waves) or personal/brand hits (D). - Do NOT rename or change the product's `draft` task state or the SDK spec's "draft task" wording (D1). - Do NOT change any repo's visibility (D8); do NOT publish packages to PyPI/npm. - Do NOT relicense agent-sdk or agent-connectors (Apache-2.0 stays); do NOT change the CE license's terms beyond removing the draft banner and origin line. - Do NOT remove functionally required third-party names (S1) — provider CLIs, protocols, dependencies, forge names. - Do NOT edit monorepo files that ship to no mirror for §5 hygiene (S2) (the `skynet` rename alone is exempt, A2); do NOT rewrite the monorepo's own history. - Do NOT change jaah-ce's `ce-staging` environment or the edition seam / API cut. - Do NOT edit the mirrors directly except the one-time history reset and branch/tag/release/package deletion in R5; every content change lands in the monorepo and reaches the mirror by its publish workflow. - Do NOT change the SDK v2 API or the `jaah.ai` extension spec semantics. - Do NOT write to any mirror repo before the final publish child (A5). Done means: - Over the built trees, the sensitive check's tracking category reports zero hits for every shipped path outside `apps/api/` and `apps/web/` (incl. the "paths to docs that do not ship" rule) — run `tools/mirror/check.py <tree> --manifest <m>` per manifest WITHOUT a baseline, filtered to this area, and cite. - The tracking rows for this area are deleted from `tools/mirror/sensitive_baseline.toml`. - Quality (tightened): a reviewer (code-reviewer lane) reads the diff hunk by hunk and finds no dangling clause, orphaned "see"/"per"/"seen on" fragment, or comment that lost its meaning; cite the review verdict. A regex-only diff that leaves fragments fails this child. - No behaviour change: `./dc check full` green in the merge lane.