e878dca78b
The internal/client package comment said CP org calls "use the same key/CP-admin bearer", which implied the tenant Org API Key could be sent to the control plane. The code (cpAdminClient) uses a DISTINCT CP-admin bearer (MOLECULE_CP_ADMIN_TOKEN) and never sends the tenant key to the CP; align the comment to match the detailed doc-comment in the orgs section and the implementation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>