docs: update TODO.md Workflow and Status for the next branching model (closes #106)

The Workflow section still told contributors to branch from `main` and
merge there. Rewrite it to the current model: branch per issue from
`next`, PR based on `next`, an independent reviewer gates it, the
manager squash-merges into `next`, and only the owner merges `next`
into `main` via the milestone PR. Update the Status paragraph so it no
longer says work is green on `main`, and record that the `1.0.0`
milestone is in progress with `next` at the canonical golangci-lint
v2.12.2 config. Docs-only; the rest of the file is left unreflowed
(that is issue 100).

model: claude-opus-4-8

TODO.md

@@ -1,21 +1,27 @@
 # Workflow
 
-* branch (from `main`)
+* branch per issue from `next`
 * do the work in Next Step
 * move Next Step to the top of Completed Steps
 * move the top item of Future Steps into Next Step
 * commit (`TODO.md` changes in the same commit as the work)
-* merge to `main` if the branch is not protected, otherwise open a PR
+* open a PR based on `next`
+* an independent reviewer who did not write the change gates it
+* the manager squash-merges the PR into `next` once review passes
+* `next` stays green and mergeable to `main` at any time; only the owner
+  merges `next` into `main`, via the single milestone PR
 * push
 
 # Status
 
-pre-1.0. No git tags exist. Recent work extracted the internal/magic,
+pre-1.0. No git tags exist. The `1.0.0` milestone is in progress; work
+lands on `next`, and `main` receives only the milestone PR that the
+owner merges. `next` is at the canonical `golangci-lint` v2.12.2 config
+and is green. Recent work extracted the internal/magic,
 internal/allowlist, internal/httpfetcher, and internal/signature
-packages. The gosec findings from the 2026-07-06 survey are resolved
-and `make check` is green on main. The disk cache is now size-bounded
-with LRU eviction (`cache_max_bytes`), closing the unbounded disk
-growth DoS vector.
+packages. The gosec findings from the 2026-07-06 survey are resolved.
+The disk cache is now size-bounded with LRU eviction
+(`cache_max_bytes`), closing the unbounded disk growth DoS vector.
 
 # Next Step