chore(todo): consolidate TODO comments into the five fixed marker tags

Retag every Shirabe-authored TODO comment to one of the fixed tags:
phase-c, phase-d, plugin, php-runtime, phase-e.

Upstream-authored TODO comments from Composer/Symfony are left
untouched to preserve the ported code shape.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

3 files changed, 6 insertions, 7 deletions

diff --git a/crates/shirabe/src/util/auth_helper.rs b/crates/shirabe/src/util/auth_helper.rs
index 8a621eb1..2131a107 100644
--- a/crates/shirabe/src/util/auth_helper.rs
+++ b/crates/shirabe/src/util/auth_helper.rs
@@ -496,7 +496,6 @@ impl AuthHelper {
                     username,
                 )));
             } else if password == "custom-headers" {
-                // TODO:
                 // Handle custom HTTP headers from auth.json
                 #[allow(unused_assignments)]
                 let mut custom_headers: PhpMixed = PhpMixed::Null;
diff --git a/crates/shirabe/src/util/http/curl_downloader.rs b/crates/shirabe/src/util/http/curl_downloader.rs
index 3b65b0f6..89e9661e 100644
--- a/crates/shirabe/src/util/http/curl_downloader.rs
+++ b/crates/shirabe/src/util/http/curl_downloader.rs
@@ -76,9 +76,9 @@ impl CurlDownloader {
         //   - cookie_store(true)        ~ CURL_LOCK_DATA_COOKIE
         //   - redirect(none)            ~ CURLOPT_FOLLOWLOCATION = false (we follow manually)
         // The libcurl version-specific multiplexing / accept-encoding workarounds are not needed.
-        // TODO: a brand-new reqwest client is created per CurlDownloader; that is acceptable here
+        // TODO(phase-e): a brand-new reqwest client is created per CurlDownloader; that is acceptable here
         // (one HttpDownloader owns one CurlDownloader) but not pooled across them.
-        // TODO: cookie sharing (CURL_LOCK_DATA_COOKIE) would need reqwest's `cookies` feature
+        // TODO(phase-c): cookie sharing (CURL_LOCK_DATA_COOKIE) would need reqwest's `cookies` feature
         // (.cookie_store(true)); omitted as it is not required for package downloads.
         let client = reqwest::Client::builder()
             .pool_max_idle_per_host(8)
@@ -507,10 +507,10 @@ impl CurlDownloader {
             .and_then(|v| v.as_int())
             .map(|n| n as u64);
 
-        // TODO: per-request ssl (cafile/verify_peer/local_cert) and proxy settings are reqwest
+        // TODO(phase-c): per-request ssl (cafile/verify_peer/local_cert) and proxy settings are reqwest
         // Client-level, not request-level. They are not applied here yet; a ConnectionOptions-keyed
         // Client cache (as in the design sketch) is required to honor them.
-        // TODO: CURLOPT_IPRESOLVE (force IPv4/IPv6) has no direct reqwest API.
+        // TODO(phase-c): CURLOPT_IPRESOLVE (force IPv4/IPv6) has no direct reqwest API.
         let _ = attributes;
 
         let reqwest_method =
diff --git a/crates/shirabe/src/util/loop.rs b/crates/shirabe/src/util/loop.rs
index c2fa3b08..f94788ac 100644
--- a/crates/shirabe/src/util/loop.rs
+++ b/crates/shirabe/src/util/loop.rs
@@ -49,7 +49,7 @@ impl Loop {
         let mut pending: FuturesUnordered<_> = promises.into_iter().collect();
         let mut uncaught: Option<anyhow::Error> = None;
 
-        // TODO(phase-c-promise): promises are now polled concurrently via FuturesUnordered, but
+        // TODO(phase-c): promises are now polled concurrently via FuturesUnordered, but
         // each individual future (HttpDownloader::add/add_copy etc.) still resolves through a
         // blocking bridge (curl_runtime()/sync_executor::block_on), so real I/O overlap does not
         // happen yet — the bridged future fully blocks the thread until it settles before the next
@@ -67,7 +67,7 @@ impl Loop {
     }
 
     pub fn abort_jobs(&self) {
-        // TODO(phase-c-promise): no-op until a cancellation mechanism is introduced. PHP cancels
+        // TODO(phase-c): no-op until a cancellation mechanism is introduced. PHP cancels
         // every in-flight promise group it tracks in $currentPromises; reintroduce that tracking
         // once the asynchronous workers support cancellation on a multi-thread runtime.
     }