Keep a Python test phase's lockfile install in check builds (closes #133)

A Python `test` phase that installs its packages from `Pipfile.lock` now does so above `ARG CACHEBUST`, through `script/bootstrap`, in a layer of its own. Check builds keep that layer as they keep Go's modules, and the tests still run after the line on every build. In that step `script/bootstrap` installs only system packages, pipenv and its dependencies by hash, and the lockfile's packages. The policy, both checklists and the README list the steps above the line the same way; the policy has a short example. This writes down sneak's ruling at sneak/rfscan#80 (comment).

rfscan installs pipenv by version, not by hash, so its `script/bootstrap` does not meet this rule yet.

Model: opus-5-5

TODO.md

@@ -21,6 +21,22 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-21: Check builds may now also keep the Python packages a `test` phase
+  installs from `Pipfile.lock` (issue 133), on sneak's ruling in
+  https://git.eeqj.de/sneak/rfscan/issues/80#issuecomment-153437. The install
+  comes before `ARG CACHEBUST`: `COPY script/ script/`,
+  `COPY Pipfile Pipfile.lock ./`, then `RUN script/bootstrap`. In that step
+  `script/bootstrap` installs nothing beyond system packages, pipenv and its
+  dependencies by hash, and the packages from the lockfile. It installs no
+  Python, because the tests use the base image's. `--deploy` installs only what
+  the lockfile names, checks every package against its hashes, and fails when
+  the lockfile is out of date with `Pipfile`. A kept layer holds nothing a new
+  install would refuse. A package built from source and the system packages may
+  differ in a new install. As with Go's modules, the packages are kept in a
+  layer, not a cache mount. The tests still run after `ARG CACHEBUST`, and every
+  other stage still installs its Python packages after it. `REPO_POLICIES.md`
+  gains a short Python `test` phase example, and both checklists and the README
+  state the rule the same way. rfscan picks this up on its next re-vendor.
 - 2026-10-21: The canonical `.golangci.yml` now accepts a local `replace` of
   `github.com/grafana/sobek` in a repository's root `go.mod` (issue 134), for
   homoicon, which keeps a local copy of sobek on sneak's decision in