docs(#2665): the guard's own comments still described one kimi home, not two

Same drift as the CONTEXT.md seams, one layer over: #2755 took
NON_REGISTRY_CONFIG_HOME_DESCRIPTORS from one entry to two, and five comments
across three files were left describing the one-entry world — "two live write
surfaces", "today's only entry", "today's single entry", and a <kimi>/config.toml
bullet naming only Kimi CLI's KIMI_SHARE_DIR.

The sharpest one was a wrong pointer rather than a stale count: run-tests.cjs
cited "scripts/lib/live-config-guard.cjs" for why the scope is narrow. That path
does not exist, and it names the one directory this module is deliberately NOT
in — the installer copies scripts/lib/ to users wholesale while uninstall removes
only an allowlist, which is the whole reason the guard lives one level up. A
reader following that pointer would have concluded the opposite of the decision.

Comments only; no behaviour change. lint:ci rc=0, tests/live-config-guard.test.cjs
24/24, tests/run-tests-harness.test.cjs 138/138.

tests/live-config-guard.test.cjs

@@ -172,7 +172,7 @@ describe('#2665: live-config hermeticity guard', () => {
   });
 });
 
-// ── Round 3: the two write surfaces that are not runtime config ROOTS ────────
+// ── Round 3: the write surfaces that are not runtime config ROOTS ───────────
 describe('#2665: guard watches non-root write surfaces', () => {
   test('resolveExtraWatchTargets covers $GSD_HOME/.gsd and kimi config.toml', () => {
     const home = tmpRoot();
@@ -207,7 +207,7 @@ describe('#2665: guard watches non-root write surfaces', () => {
       const targets = resolveExtraWatchTargets({ env, os: { homedir: () => home } });
 
       // Every descriptor in the array must contribute a target. Calling one
-      // named resolver instead would cover today's single entry and silently
+      // named resolver instead would cover one of today's two entries and silently
       // miss tomorrow's — the same partial-enumeration defect that put
       // KIMI_SHARE_DIR outside the scrub set, one layer over.
       for (const d of NON_REGISTRY_CONFIG_HOME_DESCRIPTORS) {