docs: bring TODO.md up to date (closes #146)

Next Step and Future Steps now list the open issues by full URL, in the
order of the review on #144,
without DNSSEC (post-1.0) or issues waiting on the owner. Shipped work,
the dropped domains and hostnames endpoints and the line about mocked
resolver tests are gone. Every Completed Steps entry is at most two lines;
none was dropped. Workflow now branches from `next` and opens PRs against
it. Wrapped by hand at 80 columns, since `make fmt` does not format
Markdown yet (#119). The old
Next Step, README sections required by policy, is not marked done: the
README still has no Getting Started, Rationale, Design or TODO section.

Model: opus-5-5

TODO.md

@@ -84,7 +84,8 @@ https://git.eeqj.de/sneak/dnswatcher/issues/104
 - CORS on `/metrics`: https://git.eeqj.de/sneak/dnswatcher/issues/100
 - rate limit on `/metrics` Basic Auth:
   https://git.eeqj.de/sneak/dnswatcher/issues/101
-- images report version `dev`: https://git.eeqj.de/sneak/dnswatcher/issues/109
+- Dockerfile lint stage and `VERSION`:
+  https://git.eeqj.de/sneak/dnswatcher/issues/109
 - trial run of the finished image:
   https://git.eeqj.de/sneak/dnswatcher/issues/149
 - `goimports` in `make fmt-check`, Markdown formatting:
@@ -94,10 +95,6 @@ https://git.eeqj.de/sneak/dnswatcher/issues/104
   https://git.eeqj.de/sneak/dnswatcher/issues/111
 - `internal/notify` shutdown tests:
   https://git.eeqj.de/sneak/dnswatcher/issues/116
-- `internal/notify` shutdown tests hang when a drain returns early:
-  https://git.eeqj.de/sneak/dnswatcher/issues/176
 - README accuracy sweep: https://git.eeqj.de/sneak/dnswatcher/issues/108
-- README sections required by policy:
-  https://git.eeqj.de/sneak/dnswatcher/issues/173
 - `script/install-precommit` in a linked worktree:
   https://git.eeqj.de/sneak/dnswatcher/issues/129