Say what a kept Python layer may not share with a new install (closes #133)

A kept layer holds nothing a new install would refuse, since pip and
pipenv checked every package against its hash. A package built from
source uses build tools pip downloads without a hash check, and system
packages may be newer in a new install, so those two can differ. The
TODO.md entry says the same.

Model: opus-5-5

TODO.md

@@ -30,13 +30,14 @@ fmt-check, and commit.
   dependencies by hash, and the packages from the lockfile, and no Python, since
   the tests use the base image's. `--deploy` installs only what the lockfile
   names, checks every package against its hashes, and fails when the lockfile is
-  out of date with `Pipfile`. A kept layer holds the same hashed packages a new
-  install would, but its system packages may be older. The packages are kept as
-  a layer, not a cache mount, for the reason Go's modules are. The tests still
-  run after `ARG CACHEBUST`, and every other stage still installs its Python
-  packages after it. `REPO_POLICIES.md` gains a short Python `test` phase
-  example, and both checklists and the README state the rule the same way.
-  rfscan picks this up on its next re-vendor.
+  out of date with `Pipfile`. A kept layer holds nothing a new install would
+  refuse, except that a package built from source and the system packages may
+  differ from a new install. The packages are kept as a layer, not a cache
+  mount, for the reason Go's modules are. The tests still run after
+  `ARG CACHEBUST`, and every other stage still installs its Python packages
+  after it. `REPO_POLICIES.md` gains a short Python `test` phase example, and
+  both checklists and the README state the rule the same way. rfscan picks this
+  up on its next re-vendor.
 - 2026-10-21: The canonical `.golangci.yml` now accepts a local `replace` of
   `github.com/grafana/sobek` in a repository's root `go.mod` (issue 134), for
   homoicon, which keeps a local copy of sobek on sneak's decision in