Eight private-tracker issue references ship outside palinode/diagnostics/, and the #207 guard does not reach them

#207 removed ten bare private-tracker references from `palinode/diagnostics/` and added a guard scoped to that package. **Eight more live outside it**, in six string constants across four files. Each was checked against this repository's tracker; all eight are wrong here. They all resolve on our private development tracker, which is why they survived review — they look correct to whoever wrote them.

**Locators are by symbol and quoted text on purpose.** Most of these sit inside long multi-line string constants; symbol-and-quote locators remain useful as lines move.

**Three outcomes, because they are not the same change.**

**1. `palinode/cli/mcp_config.py`, in the `mcp_config` command — repoint, do not delete.** This prints to the terminal in a red `WARNING` when your MCP configs diverge:

> Editing the wrong one is the silent-failure pattern documented in #189.

On this repository #189 is an unrelated issue about prompt activation, so the sentence sends a reader somewhere wrong rather than nowhere. **Point it at `docs/MCP-CONFIG-HOMES.md` instead** — that document ships, it is the canonical description of this failure, and `palinode mcp-config --diagnose` already surfaces it.

**2. `palinode/cli/init.py` ×5 — delete the references.** These are inside string constants written into *your* repository by `palinode init`:

- `HOOK_SCRIPT`: "…though it were what the session was about (#682). Strip it here, at the…"
- `WRAP_COMMAND_BODY`: "…explicit yes in this session (#618)." · "…so the note actually reaches the remote (#378). Without `push: true`…" · "…interrupted (#353). If the push succeeds, continue…"
- `WRAP_HEAVY_COMMAND_BODY`: "…would sit unpushed despite a \"heavy\" wrap (#378)."

A user should not end up owning files that cite our private issue numbers. Each sentence reads correctly without the number; **delete rather than replace, and do not substitute a URL** — a link into a private tracker is just as unusable.

**3. `palinode/cli/_api.py` and `palinode/mcp.py` — delete the references.** Both are the message of a module-level cross-surface drift assertion, identical but for the filename:

> …without PALINODE_SESSION_END_TIMEOUT override — update cli/_api.py or defaults.py to stay in sync (#377)

The message already says what to do; the trailing `(#377)` adds nothing a reader can act on.

**Then extend the guard.** `tests/test_no_issue_refs_user_surface.py` already has `test_no_issue_refs_in_diagnostics_strings`, which walks `palinode/diagnostics/` and fails on bare refs in string constants. **Widen the scanned root to `palinode/`** so the rest of the package is covered. Its pattern is `#\d{2,4}\b`, which is already narrow enough to ignore the single-digit finding numbers in `api/server.py` and `api/enrichment.py` ("Tier B finding #3", "Tier B #5") — those are not tracker references and need no exemption. Keep `tests/` out of scope; it carries deliberate fixtures, including this file's own `test_bare_number_is_rejected`.

**Verify it bites:** add a bare `#1234` to one of the fixed strings, watch the guard fail, then remove it. A guard nobody has watched fail is a guard nobody knows works.

**Scope:** four source files, plus `tests/test_no_issue_refs_user_surface.py`. **No behaviour change** — reference strings, one doc pointer, and the guard's scope.

**Context, not scope:** #196/#204 fixed this class in the parity registry, #207 in the diagnostics package. This is the last of it in `palinode/`.

Comment here to claim it. **Please wait to be assigned before opening a PR.**