docs: stop naming private repositories in a public workflow comment

The header comments I added in 5721334 listed the organisation's private
consumer repositories by name, and named a specific private repo's protected
branch, inside a repository that is public. That is the same disclosure the
automation move at 0783dc1 was meant to avoid.

Reworded to describe the constraint without the inventory. No behaviour change;
comments only. Landed as a new commit rather than an amend, since 5721334 is
already pushed.

Author: haasonsaas

.github/workflows/codex-rails-check.yml

@@ -1,10 +1,10 @@
 name: codex-rails-check
 
-# Reusable org rails check. Called by cerebro, chat, deploy, finance, maestro,
-# maestro-internal and platform. Runs on whatever runner the caller names, so it
-# may only depend on tools proven to exist on both the Hetzner VM image and the
-# ARC container image. Ruby exists on the former and not the latter, so every
-# parse step below runs on python3 + PyYAML, asserted up front by the preflight.
+# Reusable org rails check, called by repositories across the organisation.
+# It runs on whatever runner the caller names, so it may only depend on tools
+# proven to exist on every runner image we operate. Ruby exists on the older
+# self-hosted image and not on the ARC image, so every parse step below runs on
+# python3 + PyYAML, asserted up front by the preflight.
 
 on:
   pull_request:

.github/workflows/review-thread-guard.yml

@@ -1,11 +1,11 @@
 name: review-thread-guard
 
-# Produces the `unresolved-review-threads` check, which is a required status
-# check on evalops/maestro-internal main. It runs on the caller's runner, so it
-# may only depend on tools present on both the Hetzner VM image and the ARC
-# container image. The guard used to shell out to Ruby; ARC ships no Ruby, so
-# the guard now runs on python3 (standard library only) with an explicit
-# preflight and a fixture self-test that proves the gate can still fail.
+# Produces the `unresolved-review-threads` check, which callers wire up as a
+# required status check on protected branches. It runs on the caller's runner,
+# so it may only depend on tools present on every runner image we operate. The
+# guard used to shell out to Ruby; the ARC image ships no Ruby, so it now runs
+# on python3 (standard library only) with an explicit preflight and a fixture
+# self-test that proves the gate can still fail.
 
 on:
   workflow_call: