Checklists: bootstrap exception and which steps must not be CACHED

Both checklists' ARG CACHEBUST item now carries the exception
REPO_POLICIES.md gives: a step that also installs anything else, such as a
script/bootstrap that installs node packages too, comes after the line. The
verify item now says only a step that lints or tests, below ARG CACHEBUST,
must not show CACHED; the package install and module download above the line
are expected to.

Model: opus-5-5

prompts/EXISTING_REPO_CHECKLIST.md

@@ -52,12 +52,14 @@ with your task.
 - [ ] In every stage `ARG CACHEBUST` comes right after the steps that install
       system packages and download Go's modules, or right after `FROM` in a
       stage with neither, and every step that lints, tests or compiles comes
-      after it. The `script/` builds pass a new `CACHEBUST` value on every
-      build, which reruns every `RUN` step after that line and leaves the layers
-      above it and the cache mounts in place; `--no-cache` would build those
-      layers again and empty the mounts. A stage without the `ARG` line is
-      served from cache on an unchanged tree, so the scripts and the `ARG` lines
-      are re-vendored in one commit.
+      after it. A step that installs anything else as well, such as a
+      `script/bootstrap` that also installs node packages, comes after it too.
+      The `script/` builds pass a new `CACHEBUST` value on every build, which
+      reruns every `RUN` step after that line and leaves the layers above it and
+      the cache mounts in place; `--no-cache` would build those layers again and
+      empty the mounts. A stage without the `ARG` line is served from cache on
+      an unchanged tree, so the scripts and the `ARG` lines are re-vendored in
+      one commit.
 - [ ] Go: each Go stage downloads the modules (`COPY go.mod go.sum ./`,
       `RUN go mod download`) above `ARG CACHEBUST`; the steps that compile
       (`golangci-lint run`, `go test`, `go build`) mount Go's build cache
@@ -229,8 +231,10 @@ with your task.
 - [ ] `script/cibuild` succeeds in a fresh clone on a host carrying what CI has
       (the runner image `docker.gitea.com/runner-images:ubuntu-latest`: docker,
       git and node 24, with no yarn on `PATH`), and demonstrably executed the
-      checks — a sub-second build, or `CACHED` on a gate's `RUN` step, means
-      nothing ran
+      checks — a sub-second build, or `CACHED` on a step that lints or tests,
+      one of the `RUN` steps below `ARG CACHEBUST`, means nothing ran. The steps
+      that install system packages and download Go's modules above that line are
+      expected to show `CACHED`.
 - [ ] A planted lint violation fails both `make lint` and a plain
       `docker build .`; revert it afterwards
 - [ ] Commit and merge fixes before starting your actual task

prompts/NEW_REPO_CHECKLIST.md

@@ -111,12 +111,14 @@ Template files can be fetched from:
     - In every stage `ARG CACHEBUST` comes right after the steps that install
       system packages and download Go's modules, or right after `FROM` in a
       stage with neither, and every step that lints, tests or compiles comes
-      after it. The `script/` builds pass a new `CACHEBUST` value on every
-      build, which reruns every `RUN` step after that line and leaves the layers
-      above it and the cache mounts in place; `--no-cache` would build those
-      layers again and empty the mounts. A stage without the `ARG` line is
-      served from cache on an unchanged tree, so the scripts and every stage's
-      `ARG CACHEBUST` line are added in the same commit.
+      after it. A step that installs anything else as well, such as a
+      `script/bootstrap` that also installs node packages, comes after it too.
+      The `script/` builds pass a new `CACHEBUST` value on every build, which
+      reruns every `RUN` step after that line and leaves the layers above it and
+      the cache mounts in place; `--no-cache` would build those layers again and
+      empty the mounts. A stage without the `ARG` line is served from cache on
+      an unchanged tree, so the scripts and every stage's `ARG CACHEBUST` line
+      are added in the same commit.
     - Go: each Go stage downloads the modules (`COPY go.mod go.sum ./`,
       `RUN go mod download`) above `ARG CACHEBUST`; the steps that compile
       (`golangci-lint run`, `go test`, `go build`) mount Go's build cache
@@ -212,8 +214,10 @@ are thin shims calling them. Model scripts:
 - [ ] `script/cibuild` succeeds in a fresh clone on a host carrying what CI has
       (the runner image `docker.gitea.com/runner-images:ubuntu-latest`: docker,
       git and node 24, with no yarn on `PATH`), and demonstrably executed the
-      checks — a sub-second build, or `CACHED` on a gate's `RUN` step, means
-      nothing ran
+      checks — a sub-second build, or `CACHED` on a step that lints or tests,
+      one of the `RUN` steps below `ARG CACHEBUST`, means nothing ran. The steps
+      that install system packages and download Go's modules above that line are
+      expected to show `CACHED`.
 - [ ] Plant a lint violation and confirm both `make lint` and a plain
       `docker build .` fail on it; revert. A plain build that passes proves the
       final stage is missing its `COPY --from=` edge to the gate phases.