chore: shorten comments in kubernetesPodSpec.ts

Author: carderne

apps/supervisor/src/workloadManager/kubernetesPodSpec.ts

@@ -1,22 +1,15 @@
 import type { k8s } from "../clients/kubernetes.js";
 
 /**
- * Path (relative to the kubelet seccomp root, /var/lib/kubelet/seccomp) of the
- * targeted seccomp profile that blocks only io_uring_setup/enter/register and
- * allows every other syscall. Must match the profile distributed to worker nodes
- * by the infra kubeadm config.
+ * Relative path (kubelet seccomp root) of the profile blocking only io_uring
+ * syscalls. Must match the profile deployed to worker nodes.
  */
 export const BLOCK_IO_URING_SECCOMP_PROFILE = "profiles/block-io-uring.json";
 
 /**
- * Node >= 24 (libuv >= ~1.52) unconditionally creates io_uring file descriptors,
- * which cannot be checkpointed. Launching those pods under a seccomp profile that
- * fails io_uring_setup makes libuv fall back to epoll, keeping the pod
- * checkpointable. "node" (21.x), "node-22" (UV_USE_IO_URING=0 still works) and
- * "bun" do not create these descriptors, so the profile is scoped to node-24+ to
- * avoid changing the syscall surface of existing runtimes.
- *
- * Tolerant of an "experimental-" prefix in case a non-normalized value reaches here.
+ * Node >= 24 always creates io_uring fds, which can't be checkpointed. Blocking
+ * io_uring_setup makes libuv fall back to epoll. Other runtimes don't need this,
+ * so it's scoped to node-24+. Tolerates an "experimental-" prefix.
  */
 export function runtimeRequiresSeccompProfile(runtime: string | null | undefined): boolean {
   if (!runtime) return false;
@@ -25,10 +18,8 @@ export function runtimeRequiresSeccompProfile(runtime: string | null | undefined
 }
 
 /**
- * Applies the targeted Localhost profile that blocks only io_uring, preserving any
- * existing security-context fields. Unlike RuntimeDefault this restricts no other
- * syscalls, so it cannot break unrelated workloads (browsers, sandboxes, native
- * threads). Only call this for runtimes where runtimeRequiresSeccompProfile is true.
+ * Applies the io_uring-blocking seccomp profile, preserving existing
+ * security-context fields. Only call when runtimeRequiresSeccompProfile is true.
  */
 export function withBlockIoUringSeccompProfile(
   podSpec: Omit<k8s.V1PodSpec, "containers">