docs(dedup): correct the CodeQL claim on the tenant-namespace comment

The comment added in #11649 said keeping the API key id out of the digest
"avoids the false-positive CodeQL js/insufficient-password-hash on a cache/dedup
key". It does not. CodeQL raised alert #874 on the `createHash` in this very
function on the first scan after that merge: once an API-key-derived value
reaches the file at all, the query flags the sibling digest regardless of what
goes into it.

The plaintext prefix is still the right call — a namespace you can read off the
key beats one you cannot when debugging a dedup collision, and it matches
`semanticCache.generateSignature` (#3740), whose comment makes the same
incorrect claim. But a rationale that is measurably false is worse than no
rationale: the next person edits here, sees the alert the comment promised would
not happen, and doubts the design instead of the comment.

Replaced with what actually holds, plus the two things worth knowing: the alert
is dismissed per HR#14 and will come back on any edit here, and it must not be
"fixed" with a KDF — that would break the determinism dedup depends on.

Comment-only. No behaviour change; request-dedup tests 15/15.

open-sse/services/requestDedup.ts

@@ -141,8 +141,16 @@ function extractSystemContent(body: Record<string, unknown>): unknown {
  *
  * It is a PLAINTEXT prefix rather than digest input, matching
  * `semanticCache.generateSignature` (#3740): the id is an internal namespace
- * key, not a credential, and keeping it out of the digest avoids the
- * false-positive CodeQL js/insufficient-password-hash on a cache/dedup key.
+ * key, not a credential, and a namespace you can read off the key is worth more
+ * than one you cannot when debugging a dedup collision.
+ *
+ * It does NOT dodge the CodeQL js/insufficient-password-hash false positive,
+ * which the #3740 comment claims for its own version and which this comment
+ * claimed too until alert #874 was raised on the `createHash` below anyway.
+ * Once an API-key-derived value reaches this file at all, the query flags the
+ * sibling digest regardless of what actually goes into it. Dismissed per HR#14;
+ * expect it to come back on any edit here, and do not "fix" it with a KDF —
+ * that would break the determinism dedup depends on.
  *
  * Omitting `tenantId` keeps the un-namespaced hash. Keyless local-first
  * deployments have no tenant boundary to preserve, and every such install would