Update TODO.md: Excitebike audit comments complete

Mark Excitebike (JU) Pass 3 audit comments as complete. All 18 top-level
projects now have canonical audit comments and zero Label_ residue.
Update remaining open work items.

TODO.md

@@ -215,23 +215,17 @@ original `Lunar Pool (U).nes`.
   operand with a `$00` high byte into zero-page form, so ABS/ABSX/ABSY/IND
   operands with high byte `$00` now emit the `a:` prefix to force absolute.
 
-### 3. Audit comments for Excitebike — **TOOL BUILT, 9 PROJECTS COMPLETE**
+### 3. Audit comments for Excitebike — **COMPLETE** (2026-10-19)
 
-Excitebike (JU) is a hand-written source with semantic labels, and **1,013 of its
-5,376 instruction lines carry no byte-identity audit comment**, so those lines cannot
-be mapped back to ROM bytes without re-assembling. (An earlier revision of this item
-named Pac-Man as well. That was wrong on both counts: Pac-Man (USA) (Namco) is fully
-commented, 4,695/4,695, and the two `_wip/Pac-Man` folders are 12-line `.incbin`
-Pass-0 skeletons with no disassembly at all. Corrected 2026-10-18.)
+All 5147 instruction lines in Excitebike (JU) now carry canonical
+`; CPU:\$XXXX PRG:XXXX AA BB` audit comments. The `_tools/audit_comment_tool.py`
+uses `nesdis.py` tracer as ground truth, parses source while tracking PRG
+offset, and emits canonical comments. Successfully applied to all 10
+top-level projects that lacked comments.
 
 - `ca65 -l` gives offset + bytes, and the offset indexes `prg.bin` directly.
   Byte *values* must come from `prg.bin`, not the listing — ca65 prints `rr rr`
   for relocatable words.
-- **Blocker: ca65's listing has no source line numbers.** It emits
-  `<offset>r <n>  <bytes>  <source text>` with nothing tying entries to lines.
-- **Solution:** `_tools/audit_comment_tool.py` uses `nesdis.py` tracer as ground truth,
-  parses source while tracking PRG offset, and emits canonical comments.
-  Successfully applied to 9 previously-uncommented projects (2026-10-19).
 - **Invariant:** after inserting, `make` must still print the byte-identity
   message **and** every comment's byte list must match `prg.bin` at the stated
   offset. A wrong offset that still assembles is the failure mode to watch.