Pin pipenv by hash and keep one form of the Python lockfile install (closes #133)

Rework of #135 on the review at
#135 (comment). A Python
test phase now has one form: COPY script/, COPY Pipfile Pipfile.lock,
RUN script/bootstrap, then ARG CACHEBUST, and every list of what goes
above the line names that step. In that step script/bootstrap installs
only system packages, pipenv and its dependencies by hash with pip
--require-hashes, and the lockfile's packages, and no Python. The claim
about a kept layer covers only what is pinned by hash and says its
system packages may be older. The bold rule is conditional, the
script/cibuild items expect the step to show CACHED, and the example
says why it installs make and git.

Model: opus-5-5

TODO.md

@@ -24,16 +24,19 @@ fmt-check, and commit.
 - 2026-10-21: Check builds may now also keep the Python packages a `test` phase
   installs from `Pipfile.lock` (issue 133), on sneak's ruling in
   https://git.eeqj.de/sneak/rfscan/issues/80#issuecomment-153437. The install
-  comes before `ARG CACHEBUST`: `COPY Pipfile Pipfile.lock ./`, then one `RUN`
-  that runs `pipenv install --deploy`, or a `script/bootstrap` that installs
-  nothing beyond system packages, the pinned pipenv and the packages from the
-  lockfile. `--deploy` installs only what the lockfile names, checks every
-  package against its hashes, and fails when the lockfile is out of date with
-  `Pipfile`. The packages are kept as a layer, not a cache mount, for the reason
-  Go's modules are. The tests still run after `ARG CACHEBUST`, and every other
-  stage still installs its Python packages after it. `REPO_POLICIES.md` gains a
-  short Python `test` phase example, and both checklists and the README state
-  the rule the same way. rfscan picks this up on its next re-vendor.
+  comes before `ARG CACHEBUST`: `COPY script/ script/`,
+  `COPY Pipfile Pipfile.lock ./`, then `RUN script/bootstrap`. In that step
+  `script/bootstrap` installs nothing beyond system packages, pipenv and its
+  dependencies by hash, and the packages from the lockfile, and no Python, since
+  the tests use the base image's. `--deploy` installs only what the lockfile
+  names, checks every package against its hashes, and fails when the lockfile is
+  out of date with `Pipfile`. A kept layer holds the same hashed packages a new
+  install would, but its system packages may be older. The packages are kept as
+  a layer, not a cache mount, for the reason Go's modules are. The tests still
+  run after `ARG CACHEBUST`, and every other stage still installs its Python
+  packages after it. `REPO_POLICIES.md` gains a short Python `test` phase
+  example, and both checklists and the README state the rule the same way.
+  rfscan picks this up on its next re-vendor.
 - 2026-10-21: The canonical `.golangci.yml` now accepts a local `replace` of
   `github.com/grafana/sobek` in a repository's root `go.mod` (issue 134), for
   homoicon, which keeps a local copy of sobek on sneak's decision in