update comments

packages/world-module-metadata/test/MetadataModule.t.sol

@@ -40,7 +40,6 @@ contract MetadataModuleTest is Test, GasReporter {
     world.installModule(metadataModule, new bytes(0));
 
     // Transferring the namespace to the module and installing should be a no-op/idempotent and the module will return namespace ownership.
-    // TODO: is this a security concern? could someone frontrun by putting a tx in between the two calls below?
     world.transferOwnership(namespace, address(metadataModule));
     world.installModule(metadataModule, new bytes(0));
     assertEq(NamespaceOwner.get(namespace), address(this));

packages/world-module-metadata/ts/build.ts

@@ -8,6 +8,7 @@ import { worldgen } from "@latticexyz/world/node";
  */
 
 // TODO: move tablegen/worldgen to CLI commands from store/world we can run in package.json instead of a custom script
+//       (https://github.com/latticexyz/mud/issues/3030)
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const configPath = "../mud.config";