docs: describe auth comments in present tense

Sweep of every comment touched by the COR-393/COR-395 stack for transition framing: RecordLoginContext no longer claims a dual-write or a best-effort contract, the git-remote-entire package doc drops the read-time migration, newContextTokenManager and the coreapi bearer source stop referencing the deleted singleton/static paths, and the NormalizeOriginURL doc loses its dangling AuthBaseURL pointer. Each now states the current behaviour and why it holds.