docs(kindle-dedrm): normalize the last PowerShell comment em dashes (G27)

Comment-only across all three files, proven by PowerShell token-stream identity.

- firewall.ps1: the five em dashes in its comment-based help become the `--`
  form this repo's PowerShell already uses. The six em dashes inside
  `Write-Output`/`Write-Error` strings are emitted bytes and are deliberately
  untouched. This was the last .ps1/.psm1 in the tree carrying a comment em
  dash; none remain anywhere.
- firewall.ps1: two comments describing the enable and disable guards move from
  past to present tense.
- firewall.Tests.ps1: "the truthiness test this PR removed" becomes "the
  truthiness test this suite rules out", replacing a branch back-reference a
  future reader cannot follow with the artifact in front of them.
- sync-prep.sh: a comment claiming the script disables the firewall rule is
  replaced. It does not; it prints the elevated command for a human to run.

Removed narration, preserved here: "`-not $rule.Enabled` was therefore always
false and a disabled rule was never re-enabled."; "a bare truthiness test took
the disable path even for a rule that was already disabled."; "the guard
collapses to the truthiness test this PR removed."; and the deleted
"# Disable firewall rule (requires admin)".

No firewall rule, update-lock step or deletion path was weakened. All five
protected scripts are absent from the diff, and none was executed.

Verified by an independent fresh-context refutation verifier:
- The sync-prep.sh comment states a safety property, so its truth was checked
  rather than assumed. All 73 lines were analysed for execution constructs:
  the only child process is a read-only status probe guarded by an execute-bit
  test, the firewall text lives in `echo` calls and a quoted heredoc, and there
  is no eval, backtick, exec, source, xargs, runas, sudo or shell -c anywhere.
  The cited test assertion exists and passes at all nine call sites, including
  the live-run case that exercises the code the comment sits above.
- Every em dash in the HEAD file was enumerated and classified by reading the
  line, then cross-checked against the AST: lines 1-24 resolve to a single
  comment token, and all six survivors are string-literal tokens. Diffing every
  Write-Output/Write-Error line old versus new shows zero output change.
- Token-stream identity was re-derived independently rather than trusting a
  count: comparing the full Kind|Text sequence and its SHA-256, both files match
  exactly. The worker's 309/754 versus the verifier's 308/753 is an
  EndOfInput counting convention, and retaining that token reproduces the
  worker's numbers.
- The rewritten guard comments were checked to still prevent the defect
  returning: they state the failure as a property of the guard shape, so a
  future reader cannot simplify the correct comparison back into the bug. The
  test file's new claim is verifiable from two cases asserting the guard text.
- No rule-defining token appears on any changed line; the rule name, direction,
  action, program, profile and enabled flag are byte-identical.
- Pester 5.7.1: 10 passed, 0 failed, 1 skipped, and the skip is self-declared
  via Set-ItResult with a stated reason rather than a silent environmental one.
  sync-prep.test.sh: 73 ok, 0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LRWf55tWpxcSdpxEMh2eJD

Author: claude

plugins/kindle-dedrm/skills/manage/scripts/firewall.ps1

@@ -1,6 +1,6 @@
 <#
 .SYNOPSIS
-  Manage the Windows Firewall outbound block on Kindle.exe — kindle-dedrm skill.
+  Manage the Windows Firewall outbound block on Kindle.exe -- kindle-dedrm skill.
 
 .DESCRIPTION
   Idempotent enable / disable / check / remove of the firewall rule that prevents
@@ -13,10 +13,10 @@
   Profile: Any
 
 .PARAMETER Action
-  enable  — create rule if absent, set Enabled=True (DEFAULT for safe state)
-  disable — set Enabled=False (does NOT delete; sync action uses this)
-  check   — print current state, exit 0 if rule exists and matches expected shape
-  remove  — delete the rule entirely (cleanup action only)
+  enable  -- create rule if absent, set Enabled=True (DEFAULT for safe state)
+  disable -- set Enabled=False (does NOT delete; sync action uses this)
+  check   -- print current state, exit 0 if rule exists and matches expected shape
+  remove  -- delete the rule entirely (cleanup action only)
 
 .NOTES
   enable/disable/remove require elevation. check works without elevation.
@@ -71,9 +71,10 @@ switch ($Action) {
         if ($rule) {
             # Compared against 'True', never tested for truthiness. Get-NetFirewallRule's
             # Enabled is a NetSecurity enum whose members are True = 1 and False = 2, so
-            # BOTH are non-zero and both coerce to boolean $true. `-not $rule.Enabled` was
-            # therefore always false and a disabled rule was never re-enabled. The string
-            # comparison also holds when the property arrives already stringified.
+            # BOTH are non-zero and both coerce to boolean $true. `-not $rule.Enabled` is
+            # therefore always false, so a truthiness guard never re-enables a disabled
+            # rule. The string comparison also holds when the property arrives already
+            # stringified.
             if ($rule.Enabled -ne 'True') {
                 Enable-NetFirewallRule -DisplayName $RuleName | Out-Null
                 Write-Output '[firewall] re-enabled existing rule'
@@ -102,8 +103,8 @@ switch ($Action) {
             Write-Output '[firewall] not present — nothing to disable'
             exit 0
         }
-        # Same enum hazard as the enable branch above: a bare truthiness test took the
-        # disable path even for a rule that was already disabled.
+        # Same enum hazard as the enable branch above: a bare truthiness test takes the
+        # disable path even for a rule that is already disabled.
         if ($rule.Enabled -eq 'True') {
             Disable-NetFirewallRule -DisplayName $RuleName | Out-Null
             Write-Output '[firewall] disabled (rule retained — re-enable when sync is done)'

plugins/kindle-dedrm/skills/manage/scripts/sync-prep.sh

@@ -35,7 +35,8 @@ EOF
   exit 0
 fi
 
-# Disable firewall rule (requires admin)
+# Print the elevated disable command; this script never runs it. sync-prep.test.sh
+# pins that: it asserts no rm/pwsh/powershell/netsh/icacls call is made from here.
 echo "[sync-prep] disabling firewall rule (admin required)..."
 echo
 echo "  Open elevated PowerShell and run:"

plugins/kindle-dedrm/skills/manage/tests/firewall.Tests.ps1

@@ -150,9 +150,9 @@ Describe 'firewall.ps1' {
         # converts the RIGHT operand to [bool], and every non-empty string
         # converts to $true -- so 'True', 'False', and any other literal behave
         # identically here, and the guard collapses to the truthiness test this
-        # PR removed. The case therefore proves only that the fix did not BREAK
-        # a boolean-valued property; it cannot discriminate the fix from the
-        # defect, because a plain boolean never had the enum's True = 1 /
+        # suite rules out. The case therefore proves only that the fix did not
+        # BREAK a boolean-valued property; it cannot discriminate the fix from
+        # the defect, because a plain boolean never had the enum's True = 1 /
         # False = 2 aliasing the defect depended on.
         It 'does not break when Enabled arrives as a plain boolean' {
             $enable = Get-EnabledGuard -Path $script:ScriptPath -Action 'enable'