REPO_POLICIES.md

@@ -147,6 +147,7 @@ style conventions are in separate documents:
     ```
 
     Key points:
+
     - The lint stage uses the `golangci/golangci-lint` image directly (it
       includes both Go and the linter), so there is no need to install the
       linter separately.
@@ -280,6 +281,7 @@ style conventions are in separate documents:
 - **HTTP/web services must be hardened for production internet exposure before
   tagging 1.0.** This means full compliance with security best practices
   including, without limitation, all of the following:
+
     - **Security headers** on every response:
         - `Strict-Transport-Security` (HSTS) with `max-age` of at least one year
           and `includeSubDomains`.
@@ -338,6 +340,7 @@ style conventions are in separate documents:
     still expected. When in doubt, harden.
 
 - `README.md` is the primary documentation. Required sections:
+
     - **Description**: First line must include the project name, purpose,
       category (web server, SPA, CLI tool, etc.), license, and author. Example:
       "µPaaS is an MIT-licensed Go web application by @sneak that receives
@@ -365,6 +368,7 @@ style conventions are in separate documents:
 
 - Database migrations live in `internal/db/migrations/` and must be embedded in
   the binary.
+
     - `000_migration.sql` — contains ONLY the creation of the migrations
       tracking table itself. Nothing else.
     - `001_schema.sql` — the full application schema.
@@ -381,6 +385,7 @@ style conventions are in separate documents:
   `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and
   language-specific config). Everything else goes in a subdirectory. Canonical
   subdirectory names:
+
     - `bin/` — executable scripts and tools
     - `cmd/` — Go command entrypoints
     - `configs/` — configuration templates and examples