docs(engine,apply): replace ticket numbers with self-explanatory descriptions

Source comments and tests had bug-number references (#77,
PR #133) that violate the project's commit-message and code-comment
standards: comments must be self-explanatory to a reader without
access to the issue tracker. Replace each citation with a description
of the bug class itself -- 'duplicate primitive-array entries per
round-trip' instead of '#77', 'the version-mismatch warning that
preflightCheckTalosVersion exists to surface' instead of 'PR #133'.
The surrounding prose already says what the issue is, so the numbers
came out without losing context.

Pre-existing references in code this branch does not touch
(preflight_test.go's #132 reproduction comments, engine_test.go's
#66 fixture name) are left as-is -- out of scope here.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

Author: lexfrei

pkg/commands/apply.go

@@ -138,7 +138,8 @@ func apply(args []string) error {
 				// length (its COSI guard is unconditional). cosiVersionReader
 				// swallows errors and returns ok=false on rejection, so the
 				// preflight would silently no-op on the auth path — defeating
-				// the whole point of preflightCheckTalosVersion (PR #133).
+				// the whole point of the version-mismatch warning that
+				// preflightCheckTalosVersion exists to surface.
 				// cosiPreflightContext rebuilds ctx with the singular "node"
 				// key so the COSI router accepts the call; ApplyConfiguration
 				// keeps the original ctx unchanged.

pkg/commands/apply_test.go

@@ -705,8 +705,9 @@ func TestApplyTemplatesPerNode_AuthModeUsesPluralNodesMetadataKey(t *testing.T)
 // outgoing context carries the plural key, regardless of slice
 // length. cosiPreflightContext rebuilds ctx with the singular "node"
 // key so the COSI router accepts the call. Without this, the version
-// preflight added in PR #133 silently no-ops on the auth path:
-// cosiVersionReader swallows errors and returns ok=false on rejection.
+// preflight silently no-ops on the auth path: cosiVersionReader
+// swallows errors and returns ok=false on rejection, so the user
+// never sees the mismatch warning the preflight exists to surface.
 func TestCosiPreflightContext_StripsPluralAndAttachesSingular(t *testing.T) {
 	const node = "10.0.0.1"
 	in := client.WithNodes(context.Background(), node)

pkg/engine/engine.go

@@ -470,8 +470,8 @@ func isPatchDeleteDirective(n *yaml.Node) bool {
 // to primitive arrays rather than treating them as a set, so a body that
 // re-states an unchanged primitive list (the dominant case after
 // `talm template -I` writes the rendered template back into the node file as
-// the body) would otherwise duplicate every entry on each apply round-trip.
-// See cozystack/talm#77.
+// the body) would otherwise duplicate every entry on each apply round-trip:
+// every certSAN, every nameserver, every podSubnet doubles per round-trip.
 //
 // Returns (prunedBytes, allPruned, err). When allPruned is true the body
 // carried no semantic change beyond the rendered template and the caller
@@ -557,7 +557,9 @@ func pruneBodyIdentitiesAgainstRendered(body, rendered []byte) ([]byte, bool, er
 // present in rendered's array, replacing body's slice with the user-add
 // difference (when the diff is empty the entry is deleted) — this
 // neutralises Talos's strategic-merge primitive-array append behaviour
-// (cozystack/talm#77) for both byte-identical and partial-edit cases.
+// for both byte-identical and partial-edit cases — without it, every
+// `talm template -I` round-trip would double every certSAN, nameserver,
+// and podSubnet entry on the next apply.
 //
 // Object arrays (arrays whose elements are maps) are intentionally left
 // alone: configpatcher's StrategicMerge handles them via patchMergeKey

pkg/engine/engine_test.go

@@ -345,8 +345,8 @@ func TestPruneIdenticalKeys_PreservesUserIntentEmptyMap(t *testing.T) {
 // child entry is deep-equal to rendered's counterpart), the dedup
 // pass MUST collapse it. Without this, byte-identical bodies would
 // leave behind a wrapping map that strategic-merge then re-stamps,
-// re-introducing the cozystack/talm#77 duplication this branch
-// fixes.
+// re-introducing the duplicate-primitive-array-entries-per-round-trip
+// regression this branch fixes.
 func TestPruneIdenticalKeys_RemovesIdenticalNestedMap(t *testing.T) {
 	body := map[string]any{
 		"a": map[string]any{

pkg/engine/render_test.go

@@ -1762,9 +1762,9 @@ machine:
 		// rendered. Talos's strategic-merge appends to primitive arrays
 		// rather than treating them as a set, so without identity-pruning
 		// every certSANs/nameservers/validSubnets/endpoints entry doubles
-		// on every apply round-trip — this is the user-visible symptom of
-		// cozystack/talm#77 ("Duplicate array entries inserted into
-		// machine config when running talm apply").
+		// on every apply round-trip — every certSAN, every nameserver,
+		// every podSubnet appears twice on the second apply, four times
+		// on the third, and so on.
 		//
 		// Pin the post-fix contract: when the body's keys match the
 		// rendered's keys exactly (deep-equal), MergeFileAsPatch must
@@ -1819,8 +1819,9 @@ cluster:
 		// where the user adds one new entry to an array the chart already
 		// populated. Talos's strategic-merge appends primitive arrays
 		// rather than treating them as a set, so without per-element diff
-		// the rendered entries appear twice in the merged config — same
-		// duplication symptom as cozystack/talm#77, just one entry deeper.
+		// the rendered entries appear twice in the merged config — the
+		// same duplicate-primitive-array-entries-per-round-trip symptom
+		// as the byte-identical case, just one entry deeper.
 		const renderedTemplate = `version: v1alpha1
 machine:
   type: controlplane
@@ -1907,9 +1908,9 @@ machine:
 		// `talm template -I` writes each rendered document back as a body
 		// document, and Talos's strategic-merge appends to primitive arrays
 		// per-document. Without per-doc identity matching, the prune
-		// short-circuits the multi-doc input and the duplication symptom
-		// from cozystack/talm#77 reappears at the v1.12+ default — a
-		// `127.0.0.1` certSAN entry doubles on every apply round-trip.
+		// short-circuits the multi-doc input and the duplicate-primitive-
+		// array-entries-per-round-trip symptom reappears at the v1.12+
+		// default — a `127.0.0.1` certSAN entry doubles on every apply.
 		//
 		// Pin the post-fix contract: a body that re-states an unchanged
 		// multi-doc rendered template must merge to a config whose