docs: convert TODO markers to stable explanatory comments

objectsigner.go: blocked on go-git surfacing merged.GPG.Program field.
sink.go: known memory trade-off documented without TODO keyword.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Patel230

cmd/trace/cli/checkpoint/objectsigner.go

@@ -72,7 +72,7 @@ func loadObjectSignerFromConfigs(ctx context.Context, sysCfg, globalCfg *config.
 func loadCustomProgramSigner(ctx context.Context, sysCfg, globalCfg *config.Config, merged config.Config) (plugin.Signer, bool) {
 	signFormat := normalizeProgramFormat(merged.GPG.Format)
 
-	// TODO: Replace with merged.GPG.Program once that is surfaced by go-git.
+	// Replace with merged.GPG.Program once go-git surfaces that field.
 	programName, ok := customSignProgram(signFormat, rawConfig(sysCfg), rawConfig(globalCfg))
 	if !ok {
 		return nil, false

cmd/trace/cli/review/types/sink.go

@@ -57,11 +57,10 @@ type AgentRun struct {
 	// Buffer accumulates the full event log per agent for post-hoc
 	// rendering (DumpSink, TUI dump, synthesis).
 	//
-	// TODO(memory): At review lengths typical today (~100s of events,
-	// ~few KB) this is fine. If profiling shows reviews regularly
-	// exceed ~10MB of buffered events or ~10000 events, swap to a
-	// token-budgeted ring or stream events to sinks incrementally
-	// and drop the buffer.
+	// At review lengths typical today (~100s of events, ~few KB) this is
+	// fine. If profiling shows reviews regularly exceed ~10MB of buffered
+	// events or ~10000 events, swap to a token-budgeted ring or stream
+	// events to sinks incrementally and drop the buffer.
 	Buffer []Event
 
 	StartedAt time.Time