Say what a kept Python layer may not share with a new install (closes #133)

A kept layer holds nothing a new install would refuse, since pip and
pipenv checked every package against its hash. A package built from
source uses build tools pip downloads without a hash check, and system
packages may be newer in a new install, so those two can differ. The
TODO.md entry says the same.

Model: opus-5-5

prompts/REPO_POLICIES.md

@@ -389,14 +389,16 @@ style conventions are in separate documents:
       the development packages. `--deploy` installs only what `Pipfile.lock`
       names, checks every package against the lockfile's hashes, and fails when
       the lockfile is out of date with `Pipfile`.
-    - A kept layer holds the same pipenv, the same dependencies of pipenv and
-      the same lockfile packages that a new install would, because each was
-      checked against its hash. The packages `virtualenv` puts into the
-      virtualenv that pipenv creates are the same too: the `virtualenv` package,
-      one of pipenv's dependencies, copies them from wheels it ships, and its
-      hash covers those wheels. Any system packages the step installed are not
-      pinned by hash: the layer keeps the versions the package manager gave when
-      the layer was built, and a new install may get newer ones.
+    - A kept layer holds nothing a new install would refuse: pip checked pipenv
+      and its dependencies, and pipenv checked the lockfile's packages, against
+      their hashes. The packages `virtualenv` puts into the virtualenv that
+      pipenv creates come from wheels the `virtualenv` package ships, which its
+      hash covers. Two things in the layer are not fixed by a hash. A package
+      with no ready-built wheel for the image is built from source, with build
+      tools pip downloads without a hash check, so a kept layer's build of it
+      may differ from a new one. And system packages keep the versions the
+      package manager gave when the layer was built; a new install may get newer
+      ones.
     - The packages are kept in a layer rather than a cache mount for the reason
       Go's modules are: a cache mount is shared by every build on the host, and
       nothing checks its files again.