docs: code comments name the headings README has now (closes #724)

The README rewrite renamed or merged several headings that comments still
cited. Each comment now names the current heading. Line number citations of
README become headings too, and one test name drops its line numbers.

The e2e workflow's citations of "In CI" are dropped, because no section has what
they pointed at. Its comment also corrects what it says about required jobs and
open reports.

The comment on withLock() no longer states a Firefox private window exception,
because the manifest keeps the extension out of those windows.

Two comments also take corrections from reviews: the cases with no total in
DeleteAddress's warning, and the screens that say a swap's amount could not be
decoded.

Model: opus-5-5

tests/transactions.test.js

@@ -5,11 +5,11 @@
 // fraud contract blocklist, and the dust threshold.  A regression in any of
 // them does not crash — it silently stops filtering, and poisoned look-alike
 // addresses reappear in the user's transaction history.  These tests pin the
-// behaviour down in both directions: the documented attacks must be filtered,
+// behaviour down in both directions: the two attacks below must be filtered,
 // and legitimate transactions must survive untouched.
 //
-// Fixtures are static local objects modelled on the two real attacks cited in
-// the README.  Nothing here touches the network: global.fetch is replaced
+// Fixtures are static local objects modelled on two real attacks.
+// Nothing here touches the network: global.fetch is replaced
 // with a throwing stub and the only fetch path in the module under test
 // (debugFetch, from src/shared/log) is mocked at the module boundary.
 
@@ -81,7 +81,8 @@ const NOVEL_SPAM_SYMBOL = "SPAMTKN";
 // An ordinary counterparty for legitimate-transaction fixtures.
 const ORDINARY_PEER = "0x5aa0f9f1e0a1d0e0e5c1e7ce3b7dbbe9c19f0a11";
 
-// The documented default settings (README, Settings; state.js:24-27).
+// The documented default settings (README, Settings; DEFAULT_STATE in
+// src/shared/persistedState.js).
 const DEFAULT_FILTERS = {
     hideSpoofedSymbols: true,
     hideLowHolderTokens: true,
@@ -401,8 +402,8 @@ describe("known-symbol spoof verification", () => {
     });
 
     // Turning the other three filters off must not turn this one off: each
-    // filter is independent, and this is the one the README calls out as the
-    // defense against the fake "ETH" attack.
+    // filter is independent, and this is the one that stops the fake "ETH"
+    // attack.
     test("the check still runs when the other three filters are off", () => {
         const result = filterTransactions(
             [fakeEthTokenTransfer()],