Say which Dockerfile stages run script/bootstrap (closes #90)

The bullet in `prompts/REPO_POLICIES.md` that requires a `Dockerfile` said every Dockerfile installs its prerequisites by running `script/bootstrap`, while the canonical Go `Dockerfile` never runs it: its gate phases use their pinned images as they are and its build stage installs `git` inline.

The bullet now says the gate phases and the build stage take their tools from their pinned base images and install only what those images lack, and that the development environment stage, the final stage of a non-server repo, runs `script/bootstrap`. The new repo checklist says the same.

Model: opus-5-5

TODO.md

@@ -21,6 +21,12 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-04: `REPO_POLICIES.md` now says which `Dockerfile` stages run
+  `script/bootstrap` (issue 90). The gate phases and the build stage take their
+  tools from their pinned base images and install only what those images lack,
+  as the canonical Go `Dockerfile` does. The development environment stage, the
+  final stage of a non-server repo, runs `script/bootstrap`. The new repo
+  checklist says the same.
 - 2026-10-04: Fixed the server lifecycle example in
   `prompts/GO_HTTP_SERVER_CONVENTIONS.md` (issue 86). Only fx handles SIGINT and
   SIGTERM, and `Run()` in `main` exits with the shutdown's exit code. A listen