fix: downgrade 4 TODOs to XXX per repo standard

No vendor files changed. Classification of non-vendor TODOs:

TODO → XXX (someday-maybe, no commitment):
  packages/bash-local/src/run.ts:248
    — XXX(stateful-shell): design reference for future workflows;
      current spawn-per-call is deliberate and works fine.

  packages/tool-bash/src/index.ts:23,165
  packages/tool-bash/tests/tools.spec.ts:413
    — XXX(tool-bash-owner-hmr): HMR-only issue; dev-only,
      single-user cooperative editor, not a trust boundary.

All other TODOs kept as-is:
  TODO(demo)           — should fix for production deployment
  TODO(sub-agents)     — planned feature
  TODO(review)         — validation pending real adapters
  TODO(http)           — should refactor raw fetch
  TODO(permissions)    — important security feature
  TODO(rfc010-*)       — deferred ACP features, should land when resources permit
  parallel execution   — phase 1 sequential, performance improvement

packages/tool-bash/src/index.ts

@@ -20,7 +20,7 @@
  * ownership check is the fence that stops one session's agent from reading or
  * killing another session's background task.
  *
- * TODO(tool-bash-owner-hmr): the ownership map is per-plugin-instance, so an
+ * XXX(tool-bash-owner-hmr): the ownership map is per-plugin-instance, so an
  * independent HMR reload of `tool-bash` (without reloading `dsh-bash`) starts a
  * fresh map and a task spawned before the reload becomes un-owned (open to any
  * caller). This is acceptable today — HMR is dev-only, the ACP session boundary
@@ -162,7 +162,7 @@ export function apply(ctx: Context): void {
   // another session's background task. A task with no recorded owner (started by
   // a non-loop caller, `exec.agent` absent) is unowned and accessible to anyone.
   // An independent `tool-bash` HMR reload resets this map — see the
-  // TODO(tool-bash-owner-hmr) note in the module doc.
+  // XXX(tool-bash-owner-hmr) note in the module doc.
   const taskOwner = new Map<string, Agent>()
 
   /**