docs: bring TODO.md up to date (closes #146)

Next Step and Future Steps now list the open issues by full URL, in the
order of the review on #144,
without DNSSEC (post-1.0) or issues waiting on the owner; two issues filed
since the review sit next to the entries they relate to. Shipped work, the
dropped domains and hostnames endpoints and the line about mocked resolver
tests are gone. Every Completed Steps entry is at most two lines; none was
dropped. Workflow now branches from `next` and opens PRs against it.
Wrapped by hand at 80 columns, since `make fmt` does not format Markdown
yet (#119). The old Next Step,
README sections required by policy, is not marked done: it is now
#173.

Model: opus-5-5

TODO.md

@@ -84,8 +84,7 @@ https://git.eeqj.de/sneak/dnswatcher/issues/104
 - CORS on `/metrics`: https://git.eeqj.de/sneak/dnswatcher/issues/100
 - rate limit on `/metrics` Basic Auth:
   https://git.eeqj.de/sneak/dnswatcher/issues/101
-- Dockerfile lint stage and `VERSION`:
-  https://git.eeqj.de/sneak/dnswatcher/issues/109
+- images report version `dev`: https://git.eeqj.de/sneak/dnswatcher/issues/109
 - trial run of the finished image:
   https://git.eeqj.de/sneak/dnswatcher/issues/149
 - `goimports` in `make fmt-check`, Markdown formatting:
@@ -95,6 +94,10 @@ https://git.eeqj.de/sneak/dnswatcher/issues/104
   https://git.eeqj.de/sneak/dnswatcher/issues/111
 - `internal/notify` shutdown tests:
   https://git.eeqj.de/sneak/dnswatcher/issues/116
+- `internal/notify` shutdown tests hang when a drain returns early:
+  https://git.eeqj.de/sneak/dnswatcher/issues/176
 - README accuracy sweep: https://git.eeqj.de/sneak/dnswatcher/issues/108
+- README sections required by policy:
+  https://git.eeqj.de/sneak/dnswatcher/issues/173
 - `script/install-precommit` in a linked worktree:
   https://git.eeqj.de/sneak/dnswatcher/issues/129