docs: code comments name the headings README has now (closes #724)

The README rewrite renamed or merged several headings that comments still
cited. Each comment now names the current heading.

The e2e workflow's citations of "In CI" are dropped, because no section has what
they pointed at.

The comment on withLock() no longer states a Firefox private window exception,
because the manifest keeps the extension out of those windows.

Two comments also take corrections from reviews: the cases with no total in
DeleteAddress's warning, and the screens that say a swap's amount could not be
decoded.

Model: opus-5-5

script/lib/package.js

@@ -1,7 +1,7 @@
 // Turn a verified dist/ into the two distributable archives.
 //
 // Invoked by script/package, which runs `make build` first so that dist/ has
-// already been checked against the build's own receipt (see the Build Receipts
+// already been checked against the build's own receipt (see the Builds
 // section of README.md). This program does not build anything and does not
 // write into dist/: it reads the emitted tree and writes release/.
 //

script/test-e2e-firefox

@@ -60,12 +60,12 @@ main() {
 
     echo "Running the Firefox e2e suite..."
     # --shm-size=1g: Firefox needs more than the default 64MB /dev/shm.
-    # --network none: the suite stubs nothing, so this is what keeps the
-    #   run offline and deterministic. The extension swallows its own
-    #   fetch failures, so the popup flows work unchanged; see the
-    #   network note in README.md. Weaker than the Chrome suite's
-    #   fixture interception, and honestly so — it proves no request
-    #   escaped, but it cannot report which ones were attempted.
+    # --network none: the container has no network, and the suite reaches
+    #   only the test page and stub node on loopback (README.md, Browser
+    #   tests). The extension swallows its own fetch failures, so the popup
+    #   flows work unchanged. Weaker than the Chrome suite's fixture
+    #   interception, and honestly so — it proves no request escaped, but it
+    #   cannot report which ones were attempted.
     # HOME=/tmp: the image's root home is not a reliable place for the
     #   browser profile.
     #