List the steps above ARG CACHEBUST and split the long Python install sentences (closes #133)

The ARG CACHEBUST rule and the CACHED expectation now list their steps as
bullets, the same way in the policy, the README and both checklists. The
checklists' Python item and the policy's Python point use shorter sentences
with the verb early. The TODO entry no longer counts "no Python" as an install
or says "except" where only a difference is meant.

Model: opus-5-5

TODO.md

@@ -27,17 +27,16 @@ fmt-check, and commit.
   comes before `ARG CACHEBUST`: `COPY script/ script/`,
   `COPY Pipfile Pipfile.lock ./`, then `RUN script/bootstrap`. In that step
   `script/bootstrap` installs nothing beyond system packages, pipenv and its
-  dependencies by hash, and the packages from the lockfile, and no Python, since
-  the tests use the base image's. `--deploy` installs only what the lockfile
-  names, checks every package against its hashes, and fails when the lockfile is
-  out of date with `Pipfile`. A kept layer holds nothing a new install would
-  refuse, except that a package built from source and the system packages may
-  differ from a new install. The packages are kept as a layer, not a cache
-  mount, for the reason Go's modules are. The tests still run after
-  `ARG CACHEBUST`, and every other stage still installs its Python packages
-  after it. `REPO_POLICIES.md` gains a short Python `test` phase example, and
-  both checklists and the README state the rule the same way. rfscan picks this
-  up on its next re-vendor.
+  dependencies by hash, and the packages from the lockfile. It installs no
+  Python, because the tests use the base image's. `--deploy` installs only what
+  the lockfile names, checks every package against its hashes, and fails when
+  the lockfile is out of date with `Pipfile`. A kept layer holds nothing a new
+  install would refuse. A package built from source and the system packages may
+  differ in a new install. As with Go's modules, the packages are kept in a
+  layer, not a cache mount. The tests still run after `ARG CACHEBUST`, and every
+  other stage still installs its Python packages after it. `REPO_POLICIES.md`
+  gains a short Python `test` phase example, and both checklists and the README
+  state the rule the same way. rfscan picks this up on its next re-vendor.
 - 2026-10-21: The canonical `.golangci.yml` now accepts a local `replace` of
   `github.com/grafana/sobek` in a repository's root `go.mod` (issue 134), for
   homoicon, which keeps a local copy of sobek on sneak's decision in