Name the consumer, not Dungeon's session type, in library docs

SeedPort's evidence is minted by the consumer authenticating a live
principal, and a quarantined controller leaves WorldMailbox and its
consumer authoritative. Neither comment needs to know the consumer is
Dungeon's AppSession.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

crates/ghostlight/src/controllers.rs

@@ -2603,7 +2603,7 @@ pub enum ControllerError {
 }
 
 impl ControllerError {
-    /// Quarantine only the cognition organ. WorldMailbox and AppSession remain
+    /// Quarantine only the cognition organ. WorldMailbox and its consumer remain
     /// authoritative and available; this error must never become a daemon-wide
     /// fatal signal.
     pub fn requires_quarantine(&self) -> bool {

crates/ghostlight/src/mailbox.rs

@@ -577,7 +577,7 @@ impl ElaborationPort {
 ///
 /// It carries the owner's `VerifiedPrincipalEvidence` for the session's
 /// lifetime because a multi-round session cannot re-derive it: the only minter
-/// is `AppSessionOwner` holding a live cookie, and a checkpoint that stored an
+/// is the consumer authenticating a live principal, and a checkpoint that stored an
 /// account hash so the runner could re-mint one would be a second minter and an
 /// offline forge path. The evidence is captured from the request that asked for
 /// the work and dies with the port — but holding it is also bounded by the