docs: tighten the verification cache comments

The module header explained the whole feature where naming the file's purpose
is enough, and the ordering comment described `pnpm store prune` deleting the
log without saying which versions do — pnpm/pnpm#13893 stops deleting it.

src/index.ts

@@ -33,8 +33,7 @@ async function runMain() {
 
 async function runPost() {
   const inputs = JSON.parse(getState('inputs')) as Inputs
-  // Saved ahead of the prune because `pnpm store prune` drops the
+  // pnpm versions before pnpm/pnpm#13893 delete the log during a store prune.
-  // verification log along with the rest of the store's derived state.
   await saveVerificationCache()
   pruneStore(inputs)
   await saveCache(inputs)

src/lockfile-verification-cache/index.ts

@@ -7,12 +7,9 @@ import path from 'path'
 import { removeWindowsExtendedPathPrefix } from '../windows-path'
 
 /**
- * pnpm v11+ verifies every lockfile entry against the configured
+ * Where pnpm v11+ memoizes which lockfile passed which supply-chain policies.
- * supply-chain policies (`minimumReleaseAge`, `trustPolicy`, …) and memoizes
+ * A job without it re-checks every lockfile entry against the registry, which
- * the verdict in this file, so the next install with the same lockfile and
+ * on a large repository costs more than the install.
- * the same policies skips the registry round-trips entirely. Without it a CI
- * job re-verifies the whole lockfile on every run, which on a large
- * repository costs more than the install itself.
  */
 const VERIFICATION_CACHE_FILE = 'lockfile-verified.jsonl'