refactor: les commentaires disent cap-surface et cap-enforcement

Suite du balayage commencé dans la doc : 20 occurrences de P1a/P1b dans les
commentaires, les titres de tests et le README.

Les phrases ont été récrites, pas substituées : « the breach P1a opened »
devient « the breach that cap-surface opened », et « labelled P1b's » ne
survivait pas à un nom plus long. Un lecteur qui n'a jamais entendu ni l'un ni
l'autre doit comprendre la phrase.

L'avertissement de déploiement du README garde sa force et gagne un nom :
« "anonymous" or "private" until cap-enforcement lands per-document
encryption. »

Reste une occurrence dans e2e/polyfill-entry.ts, qui part avec le lot e2e.

packages/polyfill/src/shared-wallet/account-registry.ts

@@ -896,8 +896,8 @@ const inboxCache = new Map<string, Nuri>();
  * recipient's inbox. That makes the inbox the **bootstrap of the whole
  * reachability graph** rather than a side feature — and it is why an inbox has to
  * BELONG to someone. Before this existed, an inbox was any NURI a caller passed,
- * so "read the inbox" meant "read anyone's inbox", and since P1a routes caps
- * through it, reading someone else's collected the caps addressed to them.
+ * so "read the inbox" meant "read anyone's inbox", and since cap-surface routes
+ * caps through it, reading someone else's collected the caps addressed to them.
  *
  * Created on first sight and stable thereafter. Recorded in the doc-shim under its
  * own predicate, read by its OWN query rather than added to the account SELECT: an
@@ -1144,7 +1144,7 @@ export async function listMyEntityDocs(id: string, scope: Scope): Promise<Nuri[]
   // Recover the caps by READING the Store branch, never by recomputing them from
   // the NURIs — that is the whole point of storing them. A fresh session gets back
   // exactly what was recorded, and the day the stand-in value becomes a real key
-  // (P1b) this path needs no change at all.
+  // (cap-enforcement) this path needs no change at all.
   //
   // Scoped to the current holder: another user's store caps are not ours to hold.
   const holder = getCurrentUser();