docs(bash): address Codex review — RFC states current truth, fix doc reference

- The implemented RFC named stack positions (PR-A…PR-F, "the hooks bridges (PR-F)")
  as shipped reality, violating the rule that an implemented RFC describes current
  truth and docs never name a change unit the reader cannot see. Rephrased to
  describe the hooks subsystem / a hook bridge as the standing motivating consumer,
  without PR/stack references. The decision and rationale are unchanged.
- childEnv's comment pointed at dsh-tool-bash's "module doc" for the trusted-plugin
  boundary, but that explanation lives in the package README (§ "Trusted-plugin
  boundary"), not the module JSDoc. Fixed the reference.

packages/bash/bash-local/src/run.ts

@@ -52,7 +52,8 @@ export const SENSITIVE_ENV_PATTERN = /KEY|SECRET|TOKEN/i
  * scrub pattern (the scrub guards against leaking the HARNESS's ambient
  * credentials into model-driven commands; an in-process plugin that explicitly
  * sets a var has taken responsibility for it). `extra` is NEVER model-supplied
- * — `dsh-tool-bash` does not forward model input here (see its module doc).
+ * — `dsh-tool-bash` does not forward model input here (see its README, §
+ * "Trusted-plugin boundary").
  */
 export function childEnv(extra?: Record<string, string>): NodeJS.ProcessEnv {
   const env: NodeJS.ProcessEnv = {}