Split the virtualenv sentence and date the changed documents (closes #133)

The kept-layer sentence about the packages virtualenv adds is now two
short sentences with the verb early. The policy and both checklists
carry today's date as last_modified.

Model: opus-5-5

prompts/EXISTING_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: Existing Repo Checklist
-last_modified: 2026-10-21
+last_modified: 2026-10-26
 ---
 
 Use this checklist when beginning work in a repo that may not yet conform to our

prompts/NEW_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: New Repo Checklist
-last_modified: 2026-10-21
+last_modified: 2026-10-26
 ---
 
 Use this checklist when creating a new repository from scratch. Follow the steps

prompts/REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-10-21
+last_modified: 2026-10-26
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -395,14 +395,14 @@ style conventions are in separate documents:
       the lockfile is out of date with `Pipfile`.
     - A kept layer holds nothing a new install would refuse: pip checked pipenv
       and its dependencies, and pipenv checked the lockfile's packages, against
-      their hashes. The packages `virtualenv` puts into the virtualenv that
-      pipenv creates come from wheels the `virtualenv` package ships, which its
-      hash covers. Two things in the layer are not fixed by a hash. A package
-      with no ready-built wheel for the image is built from source. pip
-      downloads the build tools without a hash check, so a kept layer's build of
-      such a package may differ from a new one. And system packages keep the
-      versions the package manager gave when the layer was built; a new install
-      may get newer ones.
+      their hashes. pipenv creates its virtual environment with the `virtualenv`
+      package. The packages that `virtualenv` adds come from wheels inside that
+      package, so the hash pip checked for it covers them. Two things in the
+      layer are not fixed by a hash. A package with no ready-built wheel for the
+      image is built from source. pip downloads the build tools without a hash
+      check, so a kept layer's build of such a package may differ from a new
+      one. And system packages keep the versions the package manager gave when
+      the layer was built; a new install may get newer ones.
     - As with Go's modules, the packages are kept in a layer, not a cache mount.
       A cache mount is shared by every build on the host, and nothing checks its
       files again.