comments cite the reference by address, not by private note (#30)

Comments that pointed into the maintainer's private reverse-engineering notes (a note by name, a
path, a section or finding id, the analysis's own name for a client function, a process word) now
carry the fact itself, cited by the reference client's address, by vmangos file and line, or as
"the reference". Nobody outside could follow those pointers.

Comment text only, plus the test-assert and log strings that carried the same pointers. No claim
changes: a comment the notes have since corrected keeps its wording here, and correcting it is
separate work.

The two reference generators, `scripts/gen-reference-globals.py` and
`scripts/gen-reference-verb-events.py`, named the private notes' layout to find their inputs. They
now take the input files as arguments (`--capture`, `--framexml`, `--names`, `--extents`,
`--disasm`). Run on the same inputs, both write the committed tables row for row; only the two
header lines that named the old environment variable change.

Checked per file:
- the code is identical: each file with its comments stripped compares equal before and after; a
  changed string literal is compared under a mask that proves only literal text moved and every
  literal kept its line count;
- no client address the old text cited was dropped;
- a second reviewer checked every added address against its derivation;
- a detector for the notes' names, paths, ids, function names and process words finds none left;
- `scripts/gates.sh` is green.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

reference/1.12-globals.tsv

@@ -1,6 +1,6 @@
 # The 1.12.1 client's global namespace. Generated by scripts/gen-reference-globals.py.
-# Source: a capture of the running client's in-world _G (the maintainer's analysis,
-# `WOW_RE`), attributed against the complete 1.12 shipped-UI corpus.
+# Source: a capture of the running client's in-world _G (the maintainer's),
+# attributed against the complete 1.12 shipped-UI corpus.
 # Also every name that corpus defines but the capture lacks, as type `lod`: the
 # twelve Blizzard_* addons are LoadOnDemand, so a live dump misses them unless
 # their windows were opened.

reference/1.12-verb-events.tsv

@@ -1,6 +1,6 @@
 # The 1.12.1 client's FrameScript events fired from inside a Lua verb, keyed by the verb.
 # Generated by scripts/gen-reference-verb-events.py from reference/1.12-shapes.tsv,
-# reference/1.12-event-firesites.tsv and the maintainer's analysis (`WOW_RE`).
+# reference/1.12-event-firesites.tsv and the maintainer's analysis.
 #
 # shape  body   = a fire site inside the verb's own extent.
 #        helper = a fire site inside a function that only registered verbs call

reference/README.md

@@ -32,8 +32,8 @@ surface is the function split: 1,100 engine functions, 1,075 FrameXML functions.
 shipped Lua is FrameXML's, and hardcoding it in Rust is a category error even when it works.
 
 Regenerating: `scripts/gen-reference-globals.py`, whose header carries the method and the traps. It
-needs a 1.12 install and the maintainer's runtime capture of the reference client's `_G`
-(`WOW_RE=<that analysis>`), which is not in this repo, so it is a manual regeneration. The table is
+needs a 1.12 install, its FrameXML extracted to a folder, and the maintainer's runtime capture of
+the reference client's `_G`, which is not in this repo, so it is a manual regeneration. The table is
 stable: it describes a client that shipped in 2006.
 
 Reading it: `scripts/api-coverage.sh` asks a real `UiScript::new()` what benilla exposes and reports
@@ -70,8 +70,8 @@ families it drops (glue-space verbs, the unit-field bridge) and why getters are
 fire is a cache-miss re-query, a state event benilla's feeds fire off the packet). A fire site is
 attributed to a function by the verified function extents plus the disassembly's padding
 boundaries, and a site past its candidate's extent is left out rather than mis-filed. The fire
-sites and the shapes are the vendored tables above; the function names and the disassembly are the
-maintainer's (`WOW_RE=<that analysis>`), so this one is a manual regeneration.
+sites and the shapes are the vendored tables above; the function names, their extents and the
+disassembly are the maintainer's, so this one is a manual regeneration.
 
 Reading it: `crates/benilla-app/src/ui_script/verb_event_gate.rs` is the gate. For every pair whose
 verb benilla registers, the module that registers the verb fires the event, or the pair is declared